e2b 2.46.4__tar.gz → 2.48.0__tar.gz

{e2b-2.46.4 → e2b-2.48.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: e2b
-Version: 2.46.4
+Version: 2.48.0
 Summary: E2B SDK that give agents cloud environments
 Author: e2b
 Author-email: e2b <hello@e2b.dev>

{e2b-2.46.4 → e2b-2.48.0}/e2b/__init__.py

@@ -47,6 +47,7 @@ from .exceptions import (
     NotEnoughSpaceException,
     NotFoundException,
     RateLimitException,
+    ServiceBusyException,
     SandboxException,
     SandboxNotFoundException,
     TemplateException,
@@ -100,6 +101,7 @@ from .sandbox.sandbox_api import (
     SandboxNetworkTransformContext,
     SandboxNetworkTransformResolver,
     SandboxNetworkUpdate,
+    SandboxOnResume,
     SandboxListOrder,
     SandboxQuery,
     SandboxState,
@@ -175,6 +177,7 @@ __all__ = [
     "Username",
     # Exceptions
     "SandboxException",
+    "ServiceBusyException",
     "TimeoutException",
     "NotFoundException",
     "FileNotFoundException",
@@ -233,6 +236,7 @@ __all__ = [
     "SandboxNetworkUpdate",
     "SandboxLifecycle",
     "SandboxOnTimeout",
+    "SandboxOnResume",
     "ALL_TRAFFIC",
     # IAM
     "SandboxIamOpts",

{e2b-2.46.4 → e2b-2.48.0}/e2b/api/__init__.py

@@ -19,6 +19,7 @@ from e2b.exceptions import (
     AuthenticationException,
     InvalidArgumentException,
     RateLimitException,
+    ServiceBusyException,
     SandboxException,
 )
 
@@ -199,9 +200,19 @@ def api_exception_from_code(
             text += f" - {message}"
         return RateLimitException(text)
 
-    return default_exception_class(f"{status_code}: {message}").with_traceback(
+    if status_code == 503:
+        text = f"{status_code}: Service temporarily unavailable, please retry."
+        if message:
+            text += f" - {message}"
+        return ServiceBusyException(text)
+
+    err = default_exception_class(f"{status_code}: {message}").with_traceback(
         stack_trace
     )
+    if isinstance(err, SandboxException):
+        err.status_code = status_code
+
+    return err
 
 
 def handle_api_exception(
@@ -215,10 +226,14 @@ def handle_api_exception(
         body = {}
 
     message = body["message"] if "message" in body else None
-    if message is None and e.status_code not in (401, 429):
-        return default_exception_class(f"{e.status_code}: {e.content}").with_traceback(
+    if message is None and e.status_code not in (401, 429, 503):
+        err = default_exception_class(f"{e.status_code}: {e.content}").with_traceback(
             stack_trace
         )
+        if isinstance(err, SandboxException):
+            err.status_code = e.status_code
+
+        return err
 
     return api_exception_from_code(
         e.status_code,

{e2b-2.46.4 → e2b-2.48.0}/e2b/api/client/models/__init__.py

@@ -1,8 +1,5 @@
 """Contains all the data models used in inputs/outputs"""
 
-from .admin_build_cancel_result import AdminBuildCancelResult
-from .admin_sandbox_kill_result import AdminSandboxKillResult
-from .admin_team_running_sandbox_counts import AdminTeamRunningSandboxCounts
 from .assign_template_tags_request import AssignTemplateTagsRequest
 from .assigned_template_tags import AssignedTemplateTags
 from .aws_registry import AWSRegistry
@@ -10,33 +7,20 @@ from .aws_registry_type import AWSRegistryType
 from .build_log_entry import BuildLogEntry
 from .build_status_reason import BuildStatusReason
 from .connect_sandbox import ConnectSandbox
-from .created_access_token import CreatedAccessToken
-from .created_team_api_key import CreatedTeamAPIKey
 from .delete_template_tags_request import DeleteTemplateTagsRequest
-from .disk_metrics import DiskMetrics
 from .error import Error
 from .gcp_registry import GCPRegistry
 from .gcp_registry_type import GCPRegistryType
 from .general_registry import GeneralRegistry
 from .general_registry_type import GeneralRegistryType
-from .identifier_masking_details import IdentifierMaskingDetails
 from .listed_sandbox import ListedSandbox
 from .log_level import LogLevel
 from .logs_direction import LogsDirection
 from .logs_source import LogsSource
-from .machine_info import MachineInfo
-from .max_team_metric import MaxTeamMetric
 from .mcp_type_0 import McpType0
-from .new_access_token import NewAccessToken
 from .new_sandbox import NewSandbox
 from .new_secret import NewSecret
-from .new_team_api_key import NewTeamAPIKey
 from .new_volume import NewVolume
-from .node import Node
-from .node_detail import NodeDetail
-from .node_metrics import NodeMetrics
-from .node_status import NodeStatus
-from .node_status_change import NodeStatusChange
 from .order_direction import OrderDirection
 from .resumed_sandbox import ResumedSandbox
 from .sandbox import Sandbox
@@ -74,9 +58,6 @@ from .secret import Secret
 from .secret_metadata import SecretMetadata
 from .secret_update import SecretUpdate
 from .snapshot_info import SnapshotInfo
-from .team import Team
-from .team_api_key import TeamAPIKey
-from .team_metric import TeamMetric
 from .team_user import TeamUser
 from .template import Template
 from .template_alias_response import TemplateAliasResponse
@@ -96,15 +77,10 @@ from .template_tag import TemplateTag
 from .template_update_request import TemplateUpdateRequest
 from .template_update_response import TemplateUpdateResponse
 from .template_with_builds import TemplateWithBuilds
-from .update_team_api_key import UpdateTeamAPIKey
 from .volume import Volume
 from .volume_and_token import VolumeAndToken
-from .volume_token import VolumeToken
 
 __all__ = (
-    "AdminBuildCancelResult",
-    "AdminSandboxKillResult",
-    "AdminTeamRunningSandboxCounts",
     "AssignedTemplateTags",
     "AssignTemplateTagsRequest",
     "AWSRegistry",
@@ -112,33 +88,20 @@ __all__ = (
     "BuildLogEntry",
     "BuildStatusReason",
     "ConnectSandbox",
-    "CreatedAccessToken",
-    "CreatedTeamAPIKey",
     "DeleteTemplateTagsRequest",
-    "DiskMetrics",
     "Error",
     "GCPRegistry",
     "GCPRegistryType",
     "GeneralRegistry",
     "GeneralRegistryType",
-    "IdentifierMaskingDetails",
     "ListedSandbox",
     "LogLevel",
     "LogsDirection",
     "LogsSource",
-    "MachineInfo",
-    "MaxTeamMetric",
     "McpType0",
-    "NewAccessToken",
     "NewSandbox",
     "NewSecret",
-    "NewTeamAPIKey",
     "NewVolume",
-    "Node",
-    "NodeDetail",
-    "NodeMetrics",
-    "NodeStatus",
-    "NodeStatusChange",
     "OrderDirection",
     "ResumedSandbox",
     "Sandbox",
@@ -176,9 +139,6 @@ __all__ = (
     "SecretMetadata",
     "SecretUpdate",
     "SnapshotInfo",
-    "Team",
-    "TeamAPIKey",
-    "TeamMetric",
     "TeamUser",
     "Template",
     "TemplateAliasResponse",
@@ -198,8 +158,6 @@ __all__ = (
     "TemplateUpdateRequest",
     "TemplateUpdateResponse",
     "TemplateWithBuilds",
-    "UpdateTeamAPIKey",
     "Volume",
     "VolumeAndToken",
-    "VolumeToken",
 )

{e2b-2.46.4 → e2b-2.48.0}/e2b/api/client/models/connect_sandbox.py

@@ -1,9 +1,11 @@
 from collections.abc import Mapping
-from typing import Any, TypeVar
+from typing import Any, TypeVar, Union
 
 from attrs import define as _attrs_define
 from attrs import field as _attrs_field
 
+from ..types import UNSET, Unset
+
 T = TypeVar("T", bound="ConnectSandbox")
 
 
@@ -12,14 +14,22 @@ class ConnectSandbox:
     """
     Attributes:
         timeout (int): Timeout in seconds from the current time after which the sandbox should expire
+        memory (Union[Unset, bool]): Defaults to true. When false and the sandbox is paused, resume from disk state
+            only: the sandbox cold-boots fresh and any memory in the snapshot is ignored, never modified or deleted. Disk
+            state has crash-recovery semantics — writes not flushed before the pause may be lost. A no-op for snapshots that
+            contain no memory. Rejected with an error in environments where this capability is not enabled, never silently
+            downgraded to a memory restore.
     """
 
     timeout: int
+    memory: Union[Unset, bool] = UNSET
     additional_properties: dict[str, Any] = _attrs_field(init=False, factory=dict)
 
     def to_dict(self) -> dict[str, Any]:
         timeout = self.timeout
 
+        memory = self.memory
+
         field_dict: dict[str, Any] = {}
         field_dict.update(self.additional_properties)
         field_dict.update(
@@ -27,6 +37,8 @@ class ConnectSandbox:
                 "timeout": timeout,
             }
         )
+        if memory is not UNSET:
+            field_dict["memory"] = memory
 
         return field_dict
 
@@ -35,8 +47,11 @@ class ConnectSandbox:
         d = dict(src_dict)
         timeout = d.pop("timeout")
 
+        memory = d.pop("memory", UNSET)
+
         connect_sandbox = cls(
             timeout=timeout,
+            memory=memory,
         )
 
         connect_sandbox.additional_properties = d

{e2b-2.46.4 → e2b-2.48.0}/e2b/api/client/models/resumed_sandbox.py

@@ -15,10 +15,16 @@ class ResumedSandbox:
     Attributes:
         timeout (Union[Unset, int]): Time to live for the sandbox in seconds. Default: 15.
         auto_pause (Union[Unset, bool]): Automatically pauses the sandbox after the timeout
+        memory (Union[Unset, bool]): Defaults to true. When false, resume from disk state only: the sandbox cold-boots
+            fresh and any memory in the snapshot is ignored, never modified or deleted. Disk state has crash-recovery
+            semantics — writes not flushed before the pause may be lost. A no-op for snapshots that contain no memory.
+            Rejected with an error in environments where this capability is not enabled, never silently downgraded to a
+            memory restore.
     """
 
     timeout: Union[Unset, int] = 15
     auto_pause: Union[Unset, bool] = UNSET
+    memory: Union[Unset, bool] = UNSET
     additional_properties: dict[str, Any] = _attrs_field(init=False, factory=dict)
 
     def to_dict(self) -> dict[str, Any]:
@@ -26,6 +32,8 @@ class ResumedSandbox:
 
         auto_pause = self.auto_pause
 
+        memory = self.memory
+
         field_dict: dict[str, Any] = {}
         field_dict.update(self.additional_properties)
         field_dict.update({})
@@ -33,6 +41,8 @@ class ResumedSandbox:
             field_dict["timeout"] = timeout
         if auto_pause is not UNSET:
             field_dict["autoPause"] = auto_pause
+        if memory is not UNSET:
+            field_dict["memory"] = memory
 
         return field_dict
 
@@ -43,9 +53,12 @@ class ResumedSandbox:
 
         auto_pause = d.pop("autoPause", UNSET)
 
+        memory = d.pop("memory", UNSET)
+
         resumed_sandbox = cls(
             timeout=timeout,
             auto_pause=auto_pause,
+            memory=memory,
         )
 
         resumed_sandbox.additional_properties = d

{e2b-2.46.4 → e2b-2.48.0}/e2b/api/client/models/sandbox_network_config.py

@@ -31,9 +31,16 @@ class SandboxNetworkConfig:
             TCP is tunneled through the proxy after allow/deny filtering; the sandbox is unaware. Domain-matched flows use
             remote DNS (ATYP=domain).
         mask_request_host (Union[Unset, str]): Specify host mask which will be used for all sandbox requests
-        rules (Union[Unset, SandboxNetworkConfigRules]): Per-domain transform rules applied to matching egress
-            HTTP/HTTPS requests. Keys are domains (e.g. "api.example.com", "example.com"). A domain listed here is not
-            automatically allowed - use allowOut to permit the traffic.
+        https_ports (Union[Unset, list[int]]): Sandbox ports that serve HTTPS rather than plaintext HTTP. Affects how
+            the proxy reaches the service inside the sandbox; the public URL is HTTPS either way. Certificates are not
+            verified, so self-signed ones work. The envd port (49983) cannot be listed.
+        rules (Union[Unset, SandboxNetworkConfigRules]): Per-domain transform rules applied to matching outbound HTTPS
+            requests. Keys may be exact DNS names (for example, "api.example.com") or a leading wildcard (for example,
+            "*.example.com"), and are normalized to lowercase on write. Wildcards match subdomains at any depth but not the
+            apex domain; a bare "*" is invalid. Exact rules take precedence, followed by the longest matching wildcard
+            suffix, and matching rule sets are not merged. Broad wildcards such as "*.com" are allowed and may expose
+            transformed credentials to every matching destination the sandbox contacts. Rules do not grant network access;
+            configure allowOut separately to permit the destination.
     """
 
     allow_public_traffic: Union[Unset, bool] = True
@@ -41,6 +48,7 @@ class SandboxNetworkConfig:
     deny_out: Union[Unset, list[str]] = UNSET
     egress_proxy: Union["SandboxEgressProxyConfigType0", None, Unset] = UNSET
     mask_request_host: Union[Unset, str] = UNSET
+    https_ports: Union[Unset, list[int]] = UNSET
     rules: Union[Unset, "SandboxNetworkConfigRules"] = UNSET
     additional_properties: dict[str, Any] = _attrs_field(init=False, factory=dict)
 
@@ -69,6 +77,10 @@ class SandboxNetworkConfig:
 
         mask_request_host = self.mask_request_host
 
+        https_ports: Union[Unset, list[int]] = UNSET
+        if not isinstance(self.https_ports, Unset):
+            https_ports = self.https_ports
+
         rules: Union[Unset, dict[str, Any]] = UNSET
         if not isinstance(self.rules, Unset):
             rules = self.rules.to_dict()
@@ -86,6 +98,8 @@ class SandboxNetworkConfig:
             field_dict["egressProxy"] = egress_proxy
         if mask_request_host is not UNSET:
             field_dict["maskRequestHost"] = mask_request_host
+        if https_ports is not UNSET:
+            field_dict["httpsPorts"] = https_ports
         if rules is not UNSET:
             field_dict["rules"] = rules
 
@@ -128,6 +142,8 @@ class SandboxNetworkConfig:
 
         mask_request_host = d.pop("maskRequestHost", UNSET)
 
+        https_ports = cast(list[int], d.pop("httpsPorts", UNSET))
+
         _rules = d.pop("rules", UNSET)
         rules: Union[Unset, SandboxNetworkConfigRules]
         if isinstance(_rules, Unset):
@@ -141,6 +157,7 @@ class SandboxNetworkConfig:
             deny_out=deny_out,
             egress_proxy=egress_proxy,
             mask_request_host=mask_request_host,
+            https_ports=https_ports,
             rules=rules,
         )
 

{e2b-2.46.4 → e2b-2.48.0}/e2b/api/client/models/sandbox_network_config_rules.py

@@ -13,8 +13,12 @@ T = TypeVar("T", bound="SandboxNetworkConfigRules")
 
 @_attrs_define
 class SandboxNetworkConfigRules:
-    """Per-domain transform rules applied to matching egress HTTP/HTTPS requests. Keys are domains (e.g. "api.example.com",
-    "example.com"). A domain listed here is not automatically allowed - use allowOut to permit the traffic.
+    """Per-domain transform rules applied to matching outbound HTTPS requests. Keys may be exact DNS names (for example,
+    "api.example.com") or a leading wildcard (for example, "*.example.com"), and are normalized to lowercase on write.
+    Wildcards match subdomains at any depth but not the apex domain; a bare "*" is invalid. Exact rules take precedence,
+    followed by the longest matching wildcard suffix, and matching rule sets are not merged. Broad wildcards such as
+    "*.com" are allowed and may expose transformed credentials to every matching destination the sandbox contacts. Rules
+    do not grant network access; configure allowOut separately to permit the destination.
 
     """
 

{e2b-2.46.4 → e2b-2.48.0}/e2b/api/client/models/sandbox_network_update_config.py

@@ -32,8 +32,13 @@ class SandboxNetworkUpdateConfig:
             egress_proxy (Union['SandboxEgressProxyConfigType0', None, Unset]): SOCKS5 proxy for sandbox egress. Outbound
                 TCP is tunneled through the proxy after allow/deny filtering; the sandbox is unaware. Domain-matched flows use
                 remote DNS (ATYP=domain).
-            rules (Union[Unset, SandboxNetworkUpdateConfigRules]): Per-domain transform rules. Replaces all existing rules
-                when provided.
+            rules (Union[Unset, SandboxNetworkUpdateConfigRules]): Per-domain transform rules applied to matching outbound
+                HTTPS requests. Replaces all existing rules when provided. Keys may be exact DNS names or a single leading
+                wildcard (for example, "*.example.com"), and are normalized to lowercase on write. Wildcards match subdomains at
+                any depth but not the apex domain; a bare "*" is invalid. Exact rules take precedence, followed by the longest
+                matching wildcard suffix, and matching rule sets are not merged. Broad wildcards such as "*.com" are allowed and
+                may expose transformed credentials to every matching destination the sandbox contacts. Rules do not grant
+                network access; configure allowOut separately to permit the destination.
             allow_internet_access (Union[Unset, bool]): Allow sandbox to access the internet. When set to false, it behaves
                 the same as specifying denyOut to 0.0.0.0/0 in the network config.
     """

{e2b-2.46.4 → e2b-2.48.0}/e2b/api/client/models/sandbox_network_update_config_rules.py

@@ -13,7 +13,14 @@ T = TypeVar("T", bound="SandboxNetworkUpdateConfigRules")
 
 @_attrs_define
 class SandboxNetworkUpdateConfigRules:
-    """Per-domain transform rules. Replaces all existing rules when provided."""
+    """Per-domain transform rules applied to matching outbound HTTPS requests. Replaces all existing rules when provided.
+    Keys may be exact DNS names or a single leading wildcard (for example, "*.example.com"), and are normalized to
+    lowercase on write. Wildcards match subdomains at any depth but not the apex domain; a bare "*" is invalid. Exact
+    rules take precedence, followed by the longest matching wildcard suffix, and matching rule sets are not merged.
+    Broad wildcards such as "*.com" are allowed and may expose transformed credentials to every matching destination the
+    sandbox contacts. Rules do not grant network access; configure allowOut separately to permit the destination.
+
+    """
 
     additional_properties: dict[str, list["SandboxNetworkRule"]] = _attrs_field(
         init=False, factory=dict

{e2b-2.46.4 → e2b-2.48.0}/e2b/exceptions.py

@@ -1,3 +1,6 @@
+from typing import Optional
+
+
 def format_sandbox_timeout_exception(message: str):
     return TimeoutException(
         f"{message}: This error is likely due to sandbox timeout. You can modify the sandbox timeout by passing 'timeout' when starting the sandbox or calling '.set_timeout' on the sandbox with the desired timeout."
@@ -15,9 +18,17 @@ class SandboxException(Exception):
     Base class for all sandbox errors.
 
     Raised when a general sandbox exception occurs.
+
+    :param status_code: HTTP status of the API response that produced this error, when there was one.
     """
 
-    pass
+    # Class-level default so subclasses that bypass this initializer (dataclass
+    # exceptions such as CommandExitException) still expose the attribute.
+    status_code: Optional[int] = None
+
+    def __init__(self, *args, status_code: Optional[int] = None):
+        super().__init__(*args)
+        self.status_code = status_code
 
 
 class TimeoutException(SandboxException):
@@ -116,6 +127,29 @@ class RateLimitException(SandboxException):
     Raised when the API rate limit is exceeded.
     """
 
+    def __init__(self, *args):
+        super().__init__(*args, status_code=429)
+
+
+class ServiceBusyException(Exception):
+    """
+    Raised when the API refused the operation because the service is
+    temporarily busy (HTTP 503): no capacity to place a sandbox right now, or
+    the node running the sandbox declined a request it cannot serve yet.
+
+    Nothing was changed by the refused call: for example a refused pause
+    leaves the sandbox running with its state intact, so the same call can be
+    retried after a short wait.
+
+    Like `AuthenticationException` and unlike the other API errors, this is not
+    a `SandboxException`: it is raised for every 503 whatever the operation, so
+    catch it explicitly.
+
+    :param status_code: HTTP status of the API response: always 503.
+    """
+
+    status_code = 503
+
 
 class BuildException(Exception):
     """

{e2b-2.46.4 → e2b-2.48.0}/e2b/sandbox/sandbox_api.py

@@ -384,6 +384,18 @@ class SandboxNetworkOpts(TypedDict):
     - Custom subdomain: `"${PORT}-myapp.example.com"`
     """
 
+    https_ports: NotRequired[List[int]]
+    """
+    Ports whose public URLs should connect to the sandbox using HTTPS.
+
+    Use this when the service listening on the port serves HTTPS (TLS) itself.
+    This is not TLS passthrough — traffic is still terminated at the E2B proxy
+    and re-encrypted on the hop to the sandbox. The backend certificate is not
+    verified, so self-signed certificates work.
+
+    Example: ``Sandbox.create(network={"https_ports": [3000]})``
+    """
+
 
 class SandboxNetworkUpdate(TypedDict, total=False):
     """
@@ -478,6 +490,7 @@ class SandboxNetworkInfo(TypedDict, total=False):
     """
     allow_public_traffic: bool
     mask_request_host: str
+    https_ports: List[int]
 
 
 class SandboxOnTimeoutPause(TypedDict):
@@ -539,7 +552,8 @@ class SandboxLifecycle(TypedDict):
     What should happen to the sandbox when timeout is reached. `"kill"` terminates
     the sandbox; `"pause"` pauses it for later resume. Accepts either the bare
     action or an object `{"action": "pause", "keep_memory": ...}` /
-    `{"action": "kill"}` to also control the pause snapshot kind. Omitted from the
+    `{"action": "kill"}` to also control the pause snapshot kind. A value outside
+    the two actions raises `InvalidArgumentException`. Omitted from the
     create request when unset, leaving the API's default (currently `"kill"`) in
     effect.
     """
@@ -570,6 +584,39 @@ class SandboxInfoLifecycle(TypedDict):
     """
 
 
+def resolve_connect_memory(
+    on_resume: Optional["SandboxOnResume"],
+) -> Union[Unset, bool]:
+    """Resolve ``on_resume`` into ``ConnectSandbox.memory``.
+
+    ``"restore"`` is the API's own default, so it travels as an omitted field.
+    """
+    # A nullish value is not a choice of restore, matching how every other
+    # nullish option is treated. Any other value outside the union never reaches
+    # the API — it is resolved here into the boolean memory field — so it cannot
+    # be rejected server-side, and resolving it to restore would silently skip
+    # the reboot the caller asked for.
+    if on_resume is None:
+        return UNSET
+    allowed = ("restore", "reboot")
+    if on_resume not in allowed:
+        raise InvalidArgumentException(
+            f"on_resume must be one of: {', '.join(allowed)} (got {on_resume!r})."
+        )
+    return False if on_resume == "reboot" else UNSET
+
+
+SandboxOnResume = Literal["restore", "reboot"]
+"""
+How a paused sandbox comes back.
+
+``"restore"`` restores the memory snapshot, so processes and open connections
+survive the pause. ``"reboot"`` ignores any memory in the snapshot and
+cold-boots from disk state alone — the rescue path for a snapshot whose memory
+image wedges the guest.
+"""
+
+
 def _resolve_network_selector(
     selector: Optional[SandboxNetworkSelector],
     rules: Mapping[str, List[SandboxNetworkRule]],
@@ -743,6 +790,8 @@ def build_network_config(
         body["allow_public_traffic"] = network["allow_public_traffic"]
     if "mask_request_host" in network:
         body["mask_request_host"] = network["mask_request_host"]
+    if network.get("https_ports") is not None:
+        body["https_ports"] = list(network["https_ports"])
 
     return body
 
@@ -813,16 +862,14 @@ def build_lifecycle_config(
     unset unless the caller chose ``keep_memory``.
     """
     # on_timeout accepts a bare action or {"action", "keep_memory"}; normalize.
-    # Only the object form carries keep_memory; anything else (a bare action
-    # string, or an unexpected value from an untyped caller) passes through as
-    # the action, so a non-"pause" value resolves to kill instead of crashing.
+    # Only the object form carries keep_memory.
     on_timeout_raw = lifecycle.get("on_timeout") if lifecycle else None
     # A missing on_timeout — or an explicit None from an untyped caller — is not
     # a choice of kill. It only resolves to kill semantics locally, for the
     # validation below and for keep_memory.
     on_timeout_configured = on_timeout_raw is not None
     if isinstance(on_timeout_raw, dict):
-        on_timeout = on_timeout_raw.get("action", "kill")
+        on_timeout = on_timeout_raw.get("action")
         keep_memory_provided = "keep_memory" in on_timeout_raw
         keep_memory = on_timeout_raw.get("keep_memory")
     else:
@@ -832,6 +879,20 @@ def build_lifecycle_config(
         keep_memory = None
         keep_memory_provided = False
 
+    allowed_actions = ("pause", "kill")
+    if on_timeout_configured and on_timeout not in allowed_actions:
+        # Name the field the caller wrote: the object form's bad value is on
+        # "action", not on on_timeout itself.
+        field = (
+            'on_timeout["action"]' if isinstance(on_timeout_raw, dict) else "on_timeout"
+        )
+        raise InvalidArgumentException(
+            f"{field} must be one of: {', '.join(allowed_actions)} (got {on_timeout!r})."
+        )
+    # The action never reaches the API — it is resolved here into the boolean
+    # auto_pause — so an unrecognized value cannot be rejected server-side, and
+    # resolving it to kill would delete the sandbox a caller asked to preserve.
+
     # keep_memory only governs a pause action. The discriminated union type
     # forbids it on action="kill"; re-check at runtime for callers that
     # bypass the type.
@@ -938,6 +999,8 @@ def from_client_network_config(
         result["allow_public_traffic"] = network.allow_public_traffic
     if not isinstance(network.mask_request_host, Unset):
         result["mask_request_host"] = network.mask_request_host
+    if not isinstance(network.https_ports, Unset):
+        result["https_ports"] = list(network.https_ports)
 
     return result