code-sandboxes 1.9.18__tar.gz → 1.9.19__tar.gz

{code_sandboxes-1.9.18 → code_sandboxes-1.9.19}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: code_sandboxes
-Version: 1.9.18
+Version: 1.9.19
 Project-URL: Home, https://github.com/datalayer/code-sandboxes
 Author-email: Datalayer <info@datalayer.io>
 License: BSD 3-Clause License

{code_sandboxes-1.9.18 → code_sandboxes-1.9.19}/code_sandboxes/__version__.py

@@ -3,4 +3,4 @@
 
 """Code Sandboxes."""
 
-__version__ = "1.9.18"
+__version__ = "1.9.19"

{code_sandboxes-1.9.18 → code_sandboxes-1.9.19}/code_sandboxes/environments/adapters/modal.py

@@ -230,8 +230,7 @@ def _install_packages(image: Any, lock_text: str) -> Any:
         # Packages install as root: every Modal build step already runs as
         # root regardless of any `USER` line (see the module docstring), so
         # this is stating what is already true rather than asking for it.
-        "uv pip sync --system --require-hashes "
-        f"--find-links {WHEELHOUSE_IMAGE_PATH} {_LOCK_PATH}",
+        f"uv pip sync --system --require-hashes --find-links {WHEELHOUSE_IMAGE_PATH} {_LOCK_PATH}",
     )
 
 
@@ -245,6 +244,40 @@ def _post_install(
     return image
 
 
+def _intermediates_of(built: Any) -> tuple[str, ...]:
+    """Every layer under a built image, by id, deepest first (E2-05, E2-09).
+
+    Each chained builder call leaves an image of its own, and deleting the
+    artifact does not delete them. Modal offers no call that lists an
+    account's images, so an intermediate nobody wrote down at build time can
+    never be found again — which is why this is recorded rather than
+    discovered. Confirmed live on 2026-09-17: a three-call chain built through
+    `Image.build` hydrates an `object_id` on every image in `deps()`, not only
+    on the last.
+
+    The built image itself is not an intermediate: it is the artifact.
+    """
+    found: list[str] = []
+    seen: set[int] = set()
+
+    def walk(image: Any) -> None:
+        if id(image) in seen:
+            return
+        seen.add(id(image))
+        for dependency in getattr(image, "deps", lambda: ())():
+            if hasattr(dependency, "deps"):
+                walk(dependency)
+        object_id = getattr(image, "object_id", None)
+        if object_id and image is not built:
+            found.append(str(object_id))
+
+    try:
+        walk(built)
+    except Exception:
+        return ()
+    return tuple(dict.fromkeys(found))
+
+
 class Builder(ManagedBuilder):
     """Modal: the capability half (E2-06) and the build (E2-05)."""
 
@@ -479,6 +512,7 @@ class Builder(ManagedBuilder):
             mutable_alias=name,
             provider_account=provider_account(self.variant, self._provider_secrets()) or None,
             contract_version=spec.contract or SANDBOX_CONTRACT_V1.version,
+            intermediates=_intermediates_of(built),
         )
 
     def _resolved_secrets(self, request: BuildRequest) -> tuple[list[BuildSecret], dict[str, str]]:
@@ -631,6 +665,56 @@ class Builder(ManagedBuilder):
             raise self._provider_error("ask whether the image exists", error) from error
         return True
 
+    def delete(self, artifact: ArtifactReference) -> None:
+        """Delete the image, and every intermediate layer this build recorded (E2-05, E2-09).
+
+        Deleting the artifact does not delete the layers under it, and Modal
+        offers no call that lists an account's images, so what is removed is
+        what `build` wrote down — an intermediate nobody recorded can never be
+        found again.
+
+        Two answers are outcomes rather than failures, both found live on
+        2026-09-17:
+
+        * **Already gone** is success. A replay of a collection must delete the
+          same set again with no harm, the same way the Datalayer collector
+          treats an artifact that is not there.
+        * **Not ours to delete.** The bottom of a chain can be an image the
+          workspace does not own — Modal's own `debian_slim` answers
+          `PermissionDenied` — and an image somebody else owns was never this
+          artifact's to collect. It is logged and stepped over, not raised.
+        """
+        sdk = self._modal_sdk()
+        client = self._client(sdk)
+        synchronizer, api_pb2 = self._modal_internals()
+
+        async def _delete(image_id: str) -> None:
+            await client.stub.ImageDelete(api_pb2.ImageDeleteRequest(image_id=image_id))
+
+        # The artifact last: an intermediate is only reachable while the
+        # record naming it survives, so a half-done collection that has
+        # dropped the image would strand them.
+        for image_id in (*artifact.intermediates, artifact.provider_artifact_id):
+            if not image_id:
+                continue
+            try:
+                # A bare coroutine on Modal's stub silently does nothing, so
+                # this runs on the SDK's own loop — see `_delete_secret`.
+                synchronizer.wrap(_delete)(image_id)
+            except sdk.exception.NotFoundError:
+                continue
+            except Exception as error:
+                if "permission" in str(error).lower():
+                    self._log(
+                        f"The Modal image {image_id} is not this account's to delete: {error}"
+                    )
+                    continue
+                if image_id == artifact.provider_artifact_id:
+                    raise self._provider_error("delete the image", error) from error
+                # One layer's refusal does not strand the rest, nor the
+                # artifact this was called to collect.
+                self._log(f"The Modal intermediate {image_id} could not be deleted: {error}")
+
     def _provider_error(self, what: str, error: BaseException) -> EnvironmentsError:
         return EnvironmentsError(
             PROVIDER_ERROR,

{code_sandboxes-1.9.18 → code_sandboxes-1.9.19}/code_sandboxes/environments/attest.py

@@ -106,6 +106,76 @@ def signature_tag(digest: str) -> str:
     return text.replace(":", "-", 1) + ".sig"
 
 
+#: Where a CycloneDX component keeps its licence, in the order they are read.
+_CYCLONEDX_LICENSE_KEYS = ("id", "name")
+#: Where an SPDX package keeps its licence. `licenseConcluded` is what the
+#: tool decided; `licenseDeclared` is what the package claimed. BuildKit
+#: writes SPDX, so this is the one that matters in practice.
+_SPDX_LICENSE_KEYS = ("licenseConcluded", "licenseDeclared")
+#: What SPDX writes when it could not tell, which is not a licence.
+_SPDX_UNKNOWN = frozenset({"NOASSERTION", "NONE", ""})
+
+
+def _spdx_licenses(document: Mapping[str, Any]) -> set[str]:
+    """What an SPDX document names, which is what BuildKit's `attest:sbom=` writes.
+
+    `licenseConcluded` is what the tool decided and `licenseDeclared` what the
+    package claimed, so the concluded one is read first and the declared one
+    only when it said nothing.
+    """
+    found: set[str] = set()
+    for package in document.get("packages") or ():
+        if not isinstance(package, Mapping):
+            continue
+        for key in _SPDX_LICENSE_KEYS:
+            value = str(package.get(key) or "").strip()
+            if value and value.upper() not in _SPDX_UNKNOWN:
+                found.add(value)
+                break
+    return found
+
+
+def _cyclonedx_licenses(document: Mapping[str, Any]) -> set[str]:
+    """What a CycloneDX document names, by id, by name, or as an expression."""
+    found: set[str] = set()
+    for component in document.get("components") or ():
+        if not isinstance(component, Mapping):
+            continue
+        for entry in component.get("licenses") or ():
+            if not isinstance(entry, Mapping):
+                continue
+            licence = entry.get("license")
+            if isinstance(licence, Mapping):
+                for key in _CYCLONEDX_LICENSE_KEYS:
+                    value = str(licence.get(key) or "").strip()
+                    if value:
+                        found.add(value)
+                        break
+            expression = str(entry.get("expression") or "").strip()
+            if expression:
+                found.add(expression)
+    return found
+
+
+def licenses_of(document: Any) -> list[str]:
+    """Every licence an SBOM names, deduplicated and sorted.
+
+    Reads both shapes the ecosystem writes: SPDX, which is what BuildKit's
+    `attest:sbom=` produces, and CycloneDX. A document in neither shape, or one
+    that names nothing, answers an empty list rather than raising: a
+    publication's licence list is worth having and never worth failing a build
+    over.
+
+    This is what a published version's snapshot carries (D-12, E2-16). Until
+    it did, `licenses` came from the scan summary — and the registry's scanner
+    reports vulnerabilities, not licences, so every publication froze an empty
+    list beside an SBOM reference.
+    """
+    if not isinstance(document, Mapping):
+        return []
+    return sorted(_spdx_licenses(document) | _cyclonedx_licenses(document))
+
+
 @dataclass(frozen=True)
 class AttestationResult:
     """What the workflow stores about an artifact once both gates have passed."""
@@ -117,6 +187,8 @@ class AttestationResult:
     size_bytes: int | None = None
     signed_now: bool = True
     """False when a replay found the signature that was already there."""
+    licenses: tuple[str, ...] = ()
+    """What the SBOM named, frozen onto the artifact for a publication to carry."""
 
     def body(self) -> dict[str, Any]:
         """The mapping `activities_environments.attest` answers."""
@@ -127,6 +199,7 @@ class AttestationResult:
             "signature_ref": self.signature_ref,
             "size_bytes": self.size_bytes,
             "signed_now": self.signed_now,
+            "licenses": list(self.licenses),
         }
 
 
@@ -515,8 +588,14 @@ class Attestor:
         size_bytes: int | None = None,
         sbom_ref: str = "",
         provenance_ref: str = "",
+        sbom: Any = None,
     ) -> AttestationResult:
-        """Scan, then sign: the order the Operator's check depends on (D-11)."""
+        """Scan, then sign: the order the Operator's check depends on (D-11).
+
+        `sbom`, when the caller has the document, is read for the licences a
+        publication carries; the registry's scanner reports vulnerabilities
+        and never licences, so there is nowhere else they come from.
+        """
         self.can_sign()
         decision = self.scan(repository=repository, digest=digest)
         if not decision.passed:
@@ -540,6 +619,7 @@ class Attestor:
             if size_bytes is not None
             else self.size_of(repository=repository, digest=digest),
             signed_now=signed_now,
+            licenses=tuple(licenses_of(sbom)),
         )
 
     def size_of(self, *, repository: str, digest: str) -> int | None:

{code_sandboxes-1.9.18 → code_sandboxes-1.9.19}/code_sandboxes/environments/build_secrets.py

@@ -28,7 +28,12 @@ from __future__ import annotations
 import os
 from typing import Any
 
-from .errors import BUILD_SECRET_UNAVAILABLE, EnvironmentsError
+from .errors import (
+    BUILD_SECRET_UNAVAILABLE,
+    CAPABILITY_UNSUPPORTED,
+    PROVIDER_ERROR,
+    EnvironmentsError,
+)
 from .spec import BuildSecret
 
 __all__ = [
@@ -150,3 +155,141 @@ def resolve_build_secret(
             retryable=False,
         )
     return value
+
+
+#: The managed variants an owner keeps a credential for (D-8). `datalayer` is
+#: not one: the platform's own builder uses the platform's own registry.
+PROVIDER_VARIANTS = frozenset({"daytona", "e2b", "modal"})
+
+
+def resolve_provider_credential(
+    variant: str,
+    *,
+    owner_uid: str,
+    iam_url: str | None = None,
+    api_key: str | None = None,
+    timeout: float = 10.0,
+    transport: Any = None,
+) -> dict[str, str]:
+    """The owner's own credential for a managed variant (PLAN_ENVS.md E2-01, D-8).
+
+    A managed artifact exists only in the account the credential opens, so the
+    build runs with the owner's keys and records a non-secret fingerprint of
+    that account. The value IAM holds is a JSON object of the environment
+    names the provider's own SDK reads — ``DAYTONA_API_KEY``,
+    ``E2B_API_KEY``, ``MODAL_TOKEN_ID`` and ``MODAL_TOKEN_SECRET``, and
+    optionally the account names ``environments/accounts.py`` reads to
+    fingerprint it — because that is the shape ``BuildCredential`` carries and
+    every adapter already reads.
+
+    Raises ``DL_ENV_CAPABILITY_UNSUPPORTED`` — not retryable — when the owner
+    has no credential for this variant. A build must be told it cannot run in
+    an account nobody configured, rather than falling back to whatever keys
+    the worker happens to hold: that would put one owner's artifact in
+    another's account, which is the one thing D-8 exists to prevent.
+    """
+    variant = (variant or "").strip().lower()
+    if variant not in PROVIDER_VARIANTS:
+        raise EnvironmentsError(
+            CAPABILITY_UNSUPPORTED,
+            f"`{variant}` is not a managed variant a credential is kept for",
+            detail={"variant": variant},
+            retryable=False,
+        )
+    key = api_key if api_key is not None else os.environ.get(IAM_API_KEY_VARIABLE, "")
+    if not key:
+        raise EnvironmentsError(
+            CAPABILITY_UNSUPPORTED,
+            f"No {IAM_API_KEY_VARIABLE} to ask IAM for the {variant} credential with",
+            detail={"variant": variant, "missing": IAM_API_KEY_VARIABLE},
+            retryable=False,
+        )
+    base = (iam_url if iam_url is not None else os.environ.get(IAM_URL_VARIABLE, "")).rstrip("/")
+    if not base:
+        raise EnvironmentsError(
+            CAPABILITY_UNSUPPORTED,
+            f"No {IAM_URL_VARIABLE} to ask for the {variant} credential",
+            detail={"variant": variant, "missing": IAM_URL_VARIABLE},
+            retryable=False,
+        )
+    try:
+        import httpx
+    except ImportError as error:
+        raise EnvironmentsError(
+            CAPABILITY_UNSUPPORTED,
+            "No HTTP client to resolve a provider credential with: install "
+            "`code-sandboxes[environments-builder]`",
+            detail={"variant": variant, "missing": "httpx"},
+            retryable=False,
+        ) from error
+    url = f"{base}/api/iam/v1/secrets/provider/{variant}/value"
+    try:
+        with httpx.Client(transport=transport, timeout=timeout) as client:
+            response = client.get(
+                url,
+                params={"owner_uid": owner_uid},
+                headers={"X-API-Key": key},
+            )
+    except httpx.HTTPError as error:
+        raise EnvironmentsError(
+            PROVIDER_ERROR,
+            f"IAM could not be reached for the {variant} credential: {error}",
+            detail={"variant": variant},
+            retryable=True,
+        ) from error
+    if response.status_code == 404:
+        raise EnvironmentsError(
+            CAPABILITY_UNSUPPORTED,
+            f"This owner has no {variant} credential: a managed build runs in "
+            f"their own account, so one must be kept before {variant} can build",
+            detail={"variant": variant, "status": 404},
+            retryable=False,
+        )
+    if response.status_code != 200:
+        raise EnvironmentsError(
+            PROVIDER_ERROR,
+            f"IAM refused the {variant} credential: {response.status_code}",
+            detail={"variant": variant, "status": response.status_code},
+            retryable=True,
+        )
+    try:
+        body = response.json()
+    except ValueError as error:
+        raise EnvironmentsError(
+            PROVIDER_ERROR,
+            f"IAM answered the {variant} credential with a body that is not valid JSON",
+            detail={"variant": variant},
+            retryable=True,
+        ) from error
+    return _provider_secrets_of(body.get("value") if isinstance(body, dict) else None, variant)
+
+
+def _provider_secrets_of(value: Any, variant: str) -> dict[str, str]:
+    """The environment names a provider credential carries, as IAM answered.
+
+    A mapping of names to values: IAM gathers them from the secrets the owner
+    already keeps, one per environment variable, and decodes them, so the
+    worker is not asked to know how a secret is stored.
+    """
+    if not isinstance(value, dict) or not value:
+        raise EnvironmentsError(
+            CAPABILITY_UNSUPPORTED,
+            f"IAM answered the {variant} credential with no usable value; a "
+            "provider credential is the environment names that provider's own "
+            "SDK reads",
+            detail={"variant": variant},
+            retryable=False,
+        )
+    secrets = {
+        str(name): str(item)
+        for name, item in value.items()
+        if str(name).strip() and str(item).strip()
+    }
+    if not secrets:
+        raise EnvironmentsError(
+            CAPABILITY_UNSUPPORTED,
+            f"The {variant} credential names nothing",
+            detail={"variant": variant},
+            retryable=False,
+        )
+    return secrets

{code_sandboxes-1.9.18 → code_sandboxes-1.9.19}/code_sandboxes/environments/builders.py

@@ -141,6 +141,14 @@ class ArtifactReference(_Model):
     provider_account: str | None = None
     contract_version: str
     architecture: str = "linux/amd64"
+    #: The layers this build left behind that deleting the artifact does not
+    #: delete (E2-05, E2-09). Modal is the variant that has them: each chained
+    #: builder call leaves an image of its own with an id, and Modal offers no
+    #: call that lists an account's images — `ImageGetOrCreate`, `ImageFromId`,
+    #: `ImageGetByTag`, `ImageListTags`, `ImageTagRevisions`, `ImagePublish`
+    #: and `ImageDelete`, and nothing that enumerates — so an intermediate
+    #: nobody wrote down is an intermediate nobody can ever find again.
+    intermediates: tuple[str, ...] = ()
 
     @model_validator(mode="after")
     def _immutable(self) -> ArtifactReference:

{code_sandboxes-1.9.18 → code_sandboxes-1.9.19}/tests/test_environment_attest.py

@@ -22,7 +22,7 @@ import subprocess
 
 import pytest
 
-from code_sandboxes.environments.attest import Attestor, attest_artifact, signature_tag
+from code_sandboxes.environments.attest import Attestor, attest_artifact, licenses_of, signature_tag
 from code_sandboxes.environments.builders import ArtifactReference
 from code_sandboxes.environments.errors import EnvironmentsError
 from code_sandboxes.environments.policy import (
@@ -689,3 +689,63 @@ def test_nothing_reaches_a_registry_when_nothing_could_sign() -> None:
         attest_artifact(artifact=artifact, attestor=an_attestor(ecr=ecr, key=""))
     assert raised.value.detail["missing"] == "DATALAYER_ENVIRONMENTS_KMS_KEY"
     assert ecr.asked == 0, "the registry was asked before anything could have been signed"
+
+
+# -- the licences a publication carries ---------------------------------------------------------
+
+
+class TestLicencesFromTheSbom:
+    """What `licenses_of` reads, and what it refuses to guess.
+
+    A published version's page says it shows the licences its SBOM names
+    (D-12, E2-16). They had nowhere to come from: the snapshot read the scan
+    summary, and the registry's scanner reports vulnerabilities.
+    """
+
+    def test_it_reads_spdx_which_is_what_buildkit_writes(self) -> None:
+        document = {
+            "packages": [
+                {"name": "gdal", "licenseConcluded": "MIT"},
+                {"name": "numpy", "licenseConcluded": "BSD-3-Clause"},
+                {"name": "again", "licenseConcluded": "MIT"},
+            ]
+        }
+        assert licenses_of(document) == ["BSD-3-Clause", "MIT"]
+
+    def test_a_concluded_licence_wins_over_a_declared_one(self) -> None:
+        """`licenseConcluded` is what the tool decided; `licenseDeclared` is the claim."""
+        document = {
+            "packages": [
+                {"licenseConcluded": "Apache-2.0", "licenseDeclared": "MIT"},
+            ]
+        }
+        assert licenses_of(document) == ["Apache-2.0"]
+
+    def test_noassertion_is_not_a_licence_and_falls_through(self) -> None:
+        """SPDX writes NOASSERTION when it could not tell, which must not be shown."""
+        document = {
+            "packages": [
+                {"licenseConcluded": "NOASSERTION", "licenseDeclared": "BSD-3-Clause"},
+                {"licenseConcluded": "NONE", "licenseDeclared": ""},
+            ]
+        }
+        assert licenses_of(document) == ["BSD-3-Clause"]
+
+    def test_it_reads_cyclonedx_by_id_by_name_and_by_expression(self) -> None:
+        document = {
+            "components": [
+                {"licenses": [{"license": {"id": "Apache-2.0"}}]},
+                {"licenses": [{"license": {"name": "Public Domain"}}]},
+                {"licenses": [{"expression": "MIT OR Apache-2.0"}]},
+            ]
+        }
+        assert licenses_of(document) == [
+            "Apache-2.0",
+            "MIT OR Apache-2.0",
+            "Public Domain",
+        ]
+
+    def test_a_document_it_does_not_understand_names_nothing(self) -> None:
+        """Never a reason to fail a build: a licence list is worth having, not dying for."""
+        for document in (None, {}, {"packages": None}, {"components": [1, 2]}, "spdx"):
+            assert licenses_of(document) == []

{code_sandboxes-1.9.18 → code_sandboxes-1.9.19}/tests/test_environment_build_secrets.py

@@ -18,8 +18,13 @@ from code_sandboxes.environments.build_secrets import (
     IAM_API_KEY_VARIABLE,
     IAM_URL_VARIABLE,
     resolve_build_secret,
+    resolve_provider_credential,
+)
+from code_sandboxes.environments.errors import (
+    BUILD_SECRET_UNAVAILABLE,
+    CAPABILITY_UNSUPPORTED,
+    EnvironmentsError,
 )
-from code_sandboxes.environments.errors import BUILD_SECRET_UNAVAILABLE, EnvironmentsError
 from code_sandboxes.environments.spec import BuildSecret
 
 SECRET = BuildSecret(id="dlsec_01J9BUILDSECRET0000000000", name="PIP_TOKEN")
@@ -215,3 +220,114 @@ def test_the_environment_variables_are_read_when_no_argument_is_given(monkeypatc
 
     value = resolve_build_secret(SECRET, owner_uid=OWNER, transport=httpx.MockTransport(handler))
     assert value == "tok-1"
+
+
+# -- the owner's own provider credential (E2-01, D-8) -------------------------------------------
+
+
+def _credential_transport(handler) -> httpx.MockTransport:
+    return httpx.MockTransport(handler)
+
+
+def test_the_credential_is_asked_for_by_variant_and_owner() -> None:
+    """A build knows whose it is and which variant it is building, never a secret id."""
+    seen: list[httpx.Request] = []
+
+    def handler(request: httpx.Request) -> httpx.Response:
+        seen.append(request)
+        return httpx.Response(
+            200,
+            json={"provider": "daytona", "value": {"DAYTONA_API_KEY": "k"}},
+        )
+
+    secrets = resolve_provider_credential(
+        "daytona",
+        owner_uid="owner-1",
+        iam_url="https://iam.example",
+        api_key="worker-key",
+        transport=_credential_transport(handler),
+    )
+    assert secrets == {"DAYTONA_API_KEY": "k"}
+    (request,) = seen
+    assert request.url.path == "/api/iam/v1/secrets/provider/daytona/value"
+    assert request.url.params["owner_uid"] == "owner-1"
+    # The worker's own key, never a person's token.
+    assert request.headers["X-API-Key"] == "worker-key"
+    assert "authorization" not in {name.lower() for name in request.headers}
+
+
+def test_the_account_names_come_through_beside_the_key() -> None:
+    """`environments/accounts.py` fingerprints the account from these, so a
+    credential is more than the key that opens it."""
+
+    def handler(_request: httpx.Request) -> httpx.Response:
+        return httpx.Response(200, json={"value": {"E2B_API_KEY": "k", "E2B_TEAM_ID": "team"}})
+
+    assert resolve_provider_credential(
+        "e2b",
+        owner_uid="owner-1",
+        iam_url="https://iam.example",
+        api_key="k",
+        transport=_credential_transport(handler),
+    ) == {"E2B_API_KEY": "k", "E2B_TEAM_ID": "team"}
+
+
+def test_an_owner_with_no_credential_is_refused_by_name_and_not_retried() -> None:
+    """Never a fallback to whatever keys the worker holds: that is the one
+    thing D-8 exists to prevent."""
+
+    def handler(_request: httpx.Request) -> httpx.Response:
+        return httpx.Response(404, json={"detail": "No credential for that provider"})
+
+    with pytest.raises(EnvironmentsError) as raised:
+        resolve_provider_credential(
+            "modal",
+            owner_uid="owner-1",
+            iam_url="https://iam.example",
+            api_key="k",
+            transport=_credential_transport(handler),
+        )
+    assert raised.value.code is CAPABILITY_UNSUPPORTED
+    assert raised.value.retryable is False
+    assert "their own account" in str(raised.value)
+
+
+def test_iam_being_away_is_retryable() -> None:
+    def handler(_request: httpx.Request) -> httpx.Response:
+        return httpx.Response(503, json={"detail": "away"})
+
+    with pytest.raises(EnvironmentsError) as raised:
+        resolve_provider_credential(
+            "daytona",
+            owner_uid="owner-1",
+            iam_url="https://iam.example",
+            api_key="k",
+            transport=_credential_transport(handler),
+        )
+    assert raised.value.retryable is True
+
+
+def test_datalayer_is_not_a_variant_a_credential_is_kept_for() -> None:
+    """The platform's own builder uses the platform's own registry."""
+    with pytest.raises(EnvironmentsError) as raised:
+        resolve_provider_credential(
+            "datalayer", owner_uid="owner-1", iam_url="https://iam.example", api_key="k"
+        )
+    assert raised.value.code is CAPABILITY_UNSUPPORTED
+
+
+def test_a_credential_that_names_nothing_is_refused() -> None:
+    for value in ({}, "a string", None, {"": "v"}):
+
+        def handler(_request: httpx.Request, value=value) -> httpx.Response:
+            return httpx.Response(200, json={"value": value})
+
+        with pytest.raises(EnvironmentsError) as raised:
+            resolve_provider_credential(
+                "daytona",
+                owner_uid="owner-1",
+                iam_url="https://iam.example",
+                api_key="k",
+                transport=_credential_transport(handler),
+            )
+        assert raised.value.code is CAPABILITY_UNSUPPORTED, value

{code_sandboxes-1.9.18 → code_sandboxes-1.9.19}/tests/test_environment_managed_builders.py

@@ -313,14 +313,14 @@ class TestTheHalfThatIsNotBuiltYet:
     `ManagedBuilder` methods on all three."""
 
     def test_modal_still_refuses_what_e2_05_did_not_build(self) -> None:
-        """`build`/`inspect`/`exists` are E2-05's; `smoke_test`, `resolve` and
-        `delete` are not — see test_environment_modal_builder.py for what
-        is built."""
+        """`build`/`inspect`/`exists` are E2-05's, and `delete` is now too — it
+        collects the intermediate layers a build recorded (E2-05, E2-09).
+        `smoke_test` and `resolve` are still not built — see
+        test_environment_modal_builder.py for what is."""
         builder = get_builder("modal")
         calls = {
             "smoke_test": lambda: builder.smoke_test(None),  # type: ignore[arg-type]
             "resolve": lambda: builder.resolve("geo@1"),
-            "delete": lambda: builder.delete(None),  # type: ignore[arg-type]
         }
         for operation, call in calls.items():
             with pytest.raises(EnvironmentsError) as raised: