runloop-api-client 1.12.1__tar.gz → 1.13.1__tar.gz

{runloop_api_client-1.12.1 → runloop_api_client-1.13.1}/.gitignore

@@ -1,4 +1,5 @@
 .prism.log
+.stdy.log
 _dev
 
 __pycache__

runloop_api_client-1.13.1/.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "1.13.1"
+}

{runloop_api_client-1.12.1 → runloop_api_client-1.13.1}/CHANGELOG.md

@@ -1,5 +1,58 @@
 # Changelog
 
+## 1.13.1 (2026-03-25)
+
+Full Changelog: [v1.13.0...v1.13.1](https://github.com/runloopai/api-client-python/compare/v1.13.0...v1.13.1)
+
+### Features
+
+* Add axon rest endpoints for raw SQL access ([#8287](https://github.com/runloopai/api-client-python/issues/8287)) ([d3135f4](https://github.com/runloopai/api-client-python/commit/d3135f4791d18c685981d3cb959568d36414ac81))
+* add BrokerMount to OpenAPI spec ([#8282](https://github.com/runloopai/api-client-python/issues/8282)) ([fc41e95](https://github.com/runloopai/api-client-python/commit/fc41e957a30f1387781d7285489372a617c50967))
+* **sdk:** add axons to OO SDK ([#766](https://github.com/runloopai/api-client-python/issues/766)) ([821cf30](https://github.com/runloopai/api-client-python/commit/821cf30a83e05c1d591eaad41485c8acf1ff3c8b))
+
+
+### Bug Fixes
+
+* **broker:** broker protocol renames for clarity / future proof ([#8285](https://github.com/runloopai/api-client-python/issues/8285)) ([4f07960](https://github.com/runloopai/api-client-python/commit/4f0796094fcc154f88bad8c243a50fbfc7c738b4))
+
+
+### Chores
+
+* **ci:** skip lint on metadata-only changes ([b276bc4](https://github.com/runloopai/api-client-python/commit/b276bc45e3549f33888df99f589473812fb153e7))
+* **tests:** bump steady to v0.19.7 ([2f380b6](https://github.com/runloopai/api-client-python/commit/2f380b6d400d6a8879313a0928eb3a9d4151d560))
+
+## 1.13.0 (2026-03-24)
+
+Full Changelog: [v1.12.1...v1.13.0](https://github.com/runloopai/api-client-python/compare/v1.12.1...v1.13.0)
+
+### Features
+
+* example for using tunnels ([#754](https://github.com/runloopai/api-client-python/issues/754)) ([97bcd70](https://github.com/runloopai/api-client-python/commit/97bcd701c6aac8077b8dea9cd4d0693d524de9b7))
+
+
+### Bug Fixes
+
+* add AxonEventView schema to OpenAPI spec for SSE subscribe endpoint ([#8274](https://github.com/runloopai/api-client-python/issues/8274)) ([618f1bb](https://github.com/runloopai/api-client-python/commit/618f1bb48ff7757e5285cddd083f49ccbbeeed3c))
+* add name to Axon ([#8277](https://github.com/runloopai/api-client-python/issues/8277)) ([7bdb527](https://github.com/runloopai/api-client-python/commit/7bdb527e9011a68f456c927f138fac22d73b3035))
+* sanitize endpoint path params ([5182d36](https://github.com/runloopai/api-client-python/commit/5182d3666b20f4fe5b245201e0b992705443d024))
+* sanitize endpoint path params ([0993026](https://github.com/runloopai/api-client-python/commit/0993026b7dd67b1f7a9a81036c7fc93ab638112d))
+* **tunnels:** allow tunnel removal ([#8257](https://github.com/runloopai/api-client-python/issues/8257)) ([6cff97e](https://github.com/runloopai/api-client-python/commit/6cff97ee43a2f2c906833e9900841e34d478d176))
+
+
+### Chores
+
+* **internal:** update gitignore ([96bd6fd](https://github.com/runloopai/api-client-python/commit/96bd6fdc7b767371b21f5753729f01020f9e78ec))
+* remove dead port configuration code, mark deprecated / ignored in the API ([#8195](https://github.com/runloopai/api-client-python/issues/8195)) ([e565324](https://github.com/runloopai/api-client-python/commit/e5653245b65f7afd6210abe1b507ae64151da9b7))
+* **tests:** bump steady to v0.19.4 ([66cb637](https://github.com/runloopai/api-client-python/commit/66cb637779eaea2cacc4b1a06ac3a33f2358b0ee))
+* **tests:** bump steady to v0.19.5 ([601c93a](https://github.com/runloopai/api-client-python/commit/601c93afffb8379770ac895b89235903c8348b00))
+* **tests:** bump steady to v0.19.6 ([95b2ffc](https://github.com/runloopai/api-client-python/commit/95b2ffc5d487f6595ec1dc73b6a34696c309f67d))
+
+
+### Refactors
+
+* **tests:** switch from prism to steady ([dd8fe60](https://github.com/runloopai/api-client-python/commit/dd8fe60922808bb0f001b49a99988004195d806f))
+* undeprecate total_count from pagination API, remove remaining_count ([#8084](https://github.com/runloopai/api-client-python/issues/8084)) ([4bd524f](https://github.com/runloopai/api-client-python/commit/4bd524fa32e6aad6efeeabd8a5bbef5e3c7ea742))
+
 ## 1.12.1 (2026-03-19)
 
 Full Changelog: [v1.12.0...v1.12.1](https://github.com/runloopai/api-client-python/compare/v1.12.0...v1.12.1)

{runloop_api_client-1.12.1 → runloop_api_client-1.13.1}/CONTRIBUTING.md

@@ -85,7 +85,7 @@ $ pip install ./path-to-wheel-file.whl
 
 ## Running tests
 
-Most tests require you to [set up a mock server](https://github.com/stoplightio/prism) against the OpenAPI spec to run the tests.
+Most tests require you to [set up a mock server](https://github.com/dgellow/steady) against the OpenAPI spec to run the tests.
 
 ```sh
 $ ./scripts/mock

{runloop_api_client-1.12.1 → runloop_api_client-1.13.1}/EXAMPLES.md

@@ -10,8 +10,9 @@ Runnable examples live in [`examples/`](./examples).
 - [Blueprint with Build Context](#blueprint-with-build-context)
 - [Devbox From Blueprint (Run Command, Shutdown)](#devbox-from-blueprint-lifecycle)
 - [Devbox Snapshot and Resume](#devbox-snapshot-resume)
+- [Devbox Tunnel (HTTP Server Access)](#devbox-tunnel)
 - [MCP Hub + Claude Code + GitHub](#mcp-github-tools)
-- [Secrets with Devbox (Create, Inject, Verify, Delete)](#secrets-with-devbox)
+- [Secrets with Devbox and Agent Gateway](#secrets-with-devbox)
 
 <a id="blueprint-with-build-context"></a>
 ## Blueprint with Build Context
@@ -105,6 +106,35 @@ uv run pytest -m smoketest tests/smoketests/examples/
 
 **Source:** [`examples/devbox_snapshot_resume.py`](./examples/devbox_snapshot_resume.py)
 
+<a id="devbox-tunnel"></a>
+## Devbox Tunnel (HTTP Server Access)
+
+**Use case:** Create a devbox with a tunnel, start an HTTP server, and access the server from the local machine through the tunnel. Uses the async SDK.
+
+**Tags:** `devbox`, `tunnel`, `networking`, `http`, `async`
+
+### Workflow
+- Create a devbox with tunnel configuration
+- Start an HTTP server inside the devbox
+- Make an HTTP request from the local machine through the tunnel
+- Validate the response
+- Shutdown the devbox
+
+### Prerequisites
+- `RUNLOOP_API_KEY`
+
+### Run
+```sh
+uv run python -m examples.devbox_tunnel
+```
+
+### Test
+```sh
+uv run pytest -m smoketest tests/smoketests/examples/
+```
+
+**Source:** [`examples/devbox_tunnel.py`](./examples/devbox_tunnel.py)
+
 <a id="mcp-github-tools"></a>
 ## MCP Hub + Claude Code + GitHub
 
@@ -138,20 +168,19 @@ uv run pytest -m smoketest tests/smoketests/examples/
 **Source:** [`examples/mcp_github_tools.py`](./examples/mcp_github_tools.py)
 
 <a id="secrets-with-devbox"></a>
-## Secrets with Devbox (Create, Inject, Verify, Delete)
+## Secrets with Devbox and Agent Gateway
 
-**Use case:** Create a secret, inject it into a devbox as an environment variable, verify access, and clean up.
+**Use case:** Use a normal secret for sensitive app data in the devbox and agent gateway for upstream API credentials that should never be exposed to the agent.
 
-**Tags:** `secrets`, `devbox`, `environment-variables`, `cleanup`
+**Tags:** `secrets`, `devbox`, `agent-gateway`, `credentials`, `environment-variables`, `cleanup`
 
 ### Workflow
-- Create a secret with a test value
-- Create a devbox with the secret mapped to an env var
-- Execute a command that reads the secret from the environment
-- Verify the value matches
-- Update the secret and verify
-- List secrets and verify the secret appears
-- Shutdown devbox and delete secret
+- Create a secret for application data that should be available inside the devbox
+- Create a separate secret for an upstream API credential
+- Create an agent gateway config for an upstream API
+- Launch a devbox with one secret injected directly and the credential wired through agent gateway
+- Verify the devbox can read MAGIC_NUMBER while the upstream API credential is replaced with gateway values
+- Shutdown the devbox and delete the gateway config and both secrets
 
 ### Prerequisites
 - `RUNLOOP_API_KEY`

{runloop_api_client-1.12.1 → runloop_api_client-1.13.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: runloop_api_client
-Version: 1.12.1
+Version: 1.13.1
 Summary: The official Python library for the runloop API
 Project-URL: Homepage, https://github.com/runloopai/api-client-python
 Project-URL: Repository, https://github.com/runloopai/api-client-python

{runloop_api_client-1.12.1 → runloop_api_client-1.13.1}/api.md

@@ -5,6 +5,7 @@ from runloop_api_client.types import (
     AfterIdle,
     AgentMount,
     AgentSource,
+    BrokerMount,
     CodeMountParameters,
     LaunchParameters,
     Mount,
@@ -87,6 +88,51 @@ Methods:
 - <code title="get /v1/agents/{id}">client.agents.<a href="./src/runloop_api_client/resources/agents.py">retrieve</a>(id) -> <a href="./src/runloop_api_client/types/agent_view.py">AgentView</a></code>
 - <code title="get /v1/agents">client.agents.<a href="./src/runloop_api_client/resources/agents.py">list</a>(\*\*<a href="src/runloop_api_client/types/agent_list_params.py">params</a>) -> <a href="./src/runloop_api_client/types/agent_view.py">SyncAgentsCursorIDPage[AgentView]</a></code>
 
+# Axons
+
+Types:
+
+```python
+from runloop_api_client.types import (
+    AxonCreateParams,
+    AxonEventView,
+    AxonListView,
+    AxonView,
+    PublishParams,
+    PublishResultView,
+)
+```
+
+Methods:
+
+- <code title="post /v1/axons">client.axons.<a href="./src/runloop_api_client/resources/axons/axons.py">create</a>(\*\*<a href="src/runloop_api_client/types/axon_create_params.py">params</a>) -> <a href="./src/runloop_api_client/types/axon_view.py">AxonView</a></code>
+- <code title="get /v1/axons/{id}">client.axons.<a href="./src/runloop_api_client/resources/axons/axons.py">retrieve</a>(id) -> <a href="./src/runloop_api_client/types/axon_view.py">AxonView</a></code>
+- <code title="get /v1/axons">client.axons.<a href="./src/runloop_api_client/resources/axons/axons.py">list</a>() -> <a href="./src/runloop_api_client/types/axon_list_view.py">AxonListView</a></code>
+- <code title="post /v1/axons/{id}/publish">client.axons.<a href="./src/runloop_api_client/resources/axons/axons.py">publish</a>(id, \*\*<a href="src/runloop_api_client/types/axon_publish_params.py">params</a>) -> <a href="./src/runloop_api_client/types/publish_result_view.py">PublishResultView</a></code>
+- <code title="get /v1/axons/{id}/subscribe/sse">client.axons.<a href="./src/runloop_api_client/resources/axons/axons.py">subscribe_sse</a>(id) -> <a href="./src/runloop_api_client/types/axon_event_view.py">AxonEventView</a></code>
+
+## Sql
+
+Types:
+
+```python
+from runloop_api_client.types.axons import (
+    SqlBatchParams,
+    SqlBatchResultView,
+    SqlColumnMetaView,
+    SqlQueryResultView,
+    SqlResultMetaView,
+    SqlStatementParams,
+    SqlStepErrorView,
+    SqlStepResultView,
+)
+```
+
+Methods:
+
+- <code title="post /v1/axons/{id}/sql/batch">client.axons.sql.<a href="./src/runloop_api_client/resources/axons/sql.py">batch</a>(id, \*\*<a href="src/runloop_api_client/types/axons/sql_batch_params.py">params</a>) -> <a href="./src/runloop_api_client/types/axons/sql_batch_result_view.py">SqlBatchResultView</a></code>
+- <code title="post /v1/axons/{id}/sql/query">client.axons.sql.<a href="./src/runloop_api_client/resources/axons/sql.py">query</a>(id, \*\*<a href="src/runloop_api_client/types/axons/sql_query_params.py">params</a>) -> <a href="./src/runloop_api_client/types/axons/sql_query_result_view.py">SqlQueryResultView</a></code>
+
 # Blueprints
 
 Types:
@@ -155,7 +201,7 @@ Methods:
 - <code title="post /v1/devboxes/{id}/keep_alive">client.devboxes.<a href="./src/runloop_api_client/resources/devboxes/devboxes.py">keep_alive</a>(id) -> object</code>
 - <code title="get /v1/devboxes/disk_snapshots">client.devboxes.<a href="./src/runloop_api_client/resources/devboxes/devboxes.py">list_disk_snapshots</a>(\*\*<a href="src/runloop_api_client/types/devbox_list_disk_snapshots_params.py">params</a>) -> <a href="./src/runloop_api_client/types/devbox_snapshot_view.py">SyncDiskSnapshotsCursorIDPage[DevboxSnapshotView]</a></code>
 - <code title="post /v1/devboxes/{id}/read_file_contents">client.devboxes.<a href="./src/runloop_api_client/resources/devboxes/devboxes.py">read_file_contents</a>(id, \*\*<a href="src/runloop_api_client/types/devbox_read_file_contents_params.py">params</a>) -> str</code>
-- <code title="post /v1/devboxes/{id}/remove_tunnel">client.devboxes.<a href="./src/runloop_api_client/resources/devboxes/devboxes.py">remove_tunnel</a>(id, \*\*<a href="src/runloop_api_client/types/devbox_remove_tunnel_params.py">params</a>) -> object</code>
+- <code title="post /v1/devboxes/{id}/remove_tunnel">client.devboxes.<a href="./src/runloop_api_client/resources/devboxes/devboxes.py">remove_tunnel</a>(id) -> object</code>
 - <code title="post /v1/devboxes/{id}/resume">client.devboxes.<a href="./src/runloop_api_client/resources/devboxes/devboxes.py">resume</a>(id) -> <a href="./src/runloop_api_client/types/devbox_view.py">DevboxView</a></code>
 - <code title="get /v1/devboxes/{id}/usage">client.devboxes.<a href="./src/runloop_api_client/resources/devboxes/devboxes.py">retrieve_resource_usage</a>(id) -> <a href="./src/runloop_api_client/types/devbox_resource_usage_view.py">DevboxResourceUsageView</a></code>
 - <code title="post /v1/devboxes/{id}/shutdown">client.devboxes.<a href="./src/runloop_api_client/resources/devboxes/devboxes.py">shutdown</a>(id, \*\*<a href="src/runloop_api_client/types/devbox_shutdown_params.py">params</a>) -> <a href="./src/runloop_api_client/types/devbox_view.py">DevboxView</a></code>

runloop_api_client-1.13.1/examples/devbox_tunnel.py

@@ -0,0 +1,117 @@
+#!/usr/bin/env -S uv run python
+"""
+---
+title: Devbox Tunnel (HTTP Server Access)
+slug: devbox-tunnel
+use_case: Create a devbox with a tunnel, start an HTTP server, and access the server from the local machine through the tunnel. Uses the async SDK.
+workflow:
+  - Create a devbox with tunnel configuration
+  - Start an HTTP server inside the devbox
+  - Make an HTTP request from the local machine through the tunnel
+  - Validate the response
+  - Shutdown the devbox
+tags:
+  - devbox
+  - tunnel
+  - networking
+  - http
+  - async
+prerequisites:
+  - RUNLOOP_API_KEY
+run: uv run python -m examples.devbox_tunnel
+test: uv run pytest -m smoketest tests/smoketests/examples/
+---
+"""
+
+from __future__ import annotations
+
+import asyncio
+
+import httpx
+
+from runloop_api_client import AsyncRunloopSDK
+
+from ._harness import run_as_cli, wrap_recipe
+from .example_types import ExampleCheck, RecipeOutput, RecipeContext
+
+HTTP_SERVER_PORT = 8080
+SERVER_STARTUP_DELAY_S = 2
+
+
+async def recipe(ctx: RecipeContext) -> RecipeOutput:
+    """Create a devbox with a tunnel, start an HTTP server, and access it from the local machine."""
+    cleanup = ctx.cleanup
+
+    sdk = AsyncRunloopSDK()
+
+    devbox = await sdk.devbox.create(
+        name="devbox-tunnel-example",
+        launch_parameters={
+            "resource_size_request": "X_SMALL",
+        },
+        tunnel={"auth_mode": "open"},
+    )
+    cleanup.add(f"devbox:{devbox.id}", devbox.shutdown)
+
+    # Start a simple HTTP server inside the devbox using Python's built-in http.server
+    # We use exec_async because the server runs indefinitely until stopped
+    server_execution = await devbox.cmd.exec_async(f"python3 -m http.server {HTTP_SERVER_PORT} --directory /tmp")
+
+    # Give the server a moment to start
+    await asyncio.sleep(SERVER_STARTUP_DELAY_S)
+
+    # The tunnel was created with the devbox. For authenticated tunnels, set
+    # tunnel={"auth_mode": "authenticated"} on create and include the auth_token
+    # in your requests via the Authorization header: `Authorization: Bearer {tunnel.auth_token}`
+    tunnel = await devbox.get_tunnel()
+    if tunnel is None:
+        raise RuntimeError("Failed to create tunnel at devbox launch time")
+
+    # Get the tunnel URL for the server port
+    tunnel_url = await devbox.get_tunnel_url(HTTP_SERVER_PORT)
+    if tunnel_url is None:
+        raise RuntimeError("Failed to get tunnel URL after creating tunnel")
+
+    # Make an HTTP request from the LOCAL MACHINE through the tunnel to the devbox
+    # This demonstrates that the tunnel allows external access to the devbox service
+    async with httpx.AsyncClient() as client:
+        response = await client.get(tunnel_url)
+        response_text = response.text
+
+    # Stop the HTTP server
+    await server_execution.kill()
+
+    return RecipeOutput(
+        resources_created=[f"devbox:{devbox.id}"],
+        checks=[
+            ExampleCheck(
+                name="tunnel was created successfully",
+                passed=bool(tunnel.tunnel_key),
+                details=f"tunnel_key={tunnel.tunnel_key}",
+            ),
+            ExampleCheck(
+                name="tunnel URL was constructed correctly",
+                passed=bool(
+                    tunnel.tunnel_key and tunnel.tunnel_key in tunnel_url and str(HTTP_SERVER_PORT) in tunnel_url
+                ),
+                details=tunnel_url,
+            ),
+            ExampleCheck(
+                name="HTTP request through tunnel succeeded",
+                passed=response.is_success,
+                details=f"status={response.status_code}",
+            ),
+            ExampleCheck(
+                name="response contains directory listing",
+                passed="Directory listing" in response_text,
+                details=response_text[:200],
+            ),
+        ],
+    )
+
+
+run_devbox_tunnel_example = wrap_recipe(recipe)
+
+
+if __name__ == "__main__":
+    run_as_cli(run_devbox_tunnel_example)

{runloop_api_client-1.12.1 → runloop_api_client-1.13.1}/examples/registry.py

@@ -7,6 +7,7 @@ from __future__ import annotations
 
 from typing import Any, Callable, cast
 
+from .devbox_tunnel import run_devbox_tunnel_example
 from .example_types import ExampleResult
 from .mcp_github_tools import run_mcp_github_tools_example
 from .secrets_with_devbox import run_secrets_with_devbox_example
@@ -38,6 +39,13 @@ example_registry: list[ExampleRegistryEntry] = [
         "required_env": ["RUNLOOP_API_KEY"],
         "run": run_devbox_snapshot_resume_example,
     },
+    {
+        "slug": "devbox-tunnel",
+        "title": "Devbox Tunnel (HTTP Server Access)",
+        "file_name": "devbox_tunnel.py",
+        "required_env": ["RUNLOOP_API_KEY"],
+        "run": run_devbox_tunnel_example,
+    },
     {
         "slug": "mcp-github-tools",
         "title": "MCP Hub + Claude Code + GitHub",
@@ -47,7 +55,7 @@ example_registry: list[ExampleRegistryEntry] = [
     },
     {
         "slug": "secrets-with-devbox",
-        "title": "Secrets with Devbox (Create, Inject, Verify, Delete)",
+        "title": "Secrets with Devbox and Agent Gateway",
         "file_name": "secrets_with_devbox.py",
         "required_env": ["RUNLOOP_API_KEY"],
         "run": run_secrets_with_devbox_example,

runloop_api_client-1.13.1/examples/secrets_with_devbox.py

@@ -0,0 +1,183 @@
+#!/usr/bin/env -S uv run python
+"""
+---
+title: Secrets with Devbox and Agent Gateway
+slug: secrets-with-devbox
+use_case: Use a normal secret for sensitive app data in the devbox and agent gateway for upstream API credentials that should never be exposed to the agent.
+workflow:
+  - Create a secret for application data that should be available inside the devbox
+  - Create a separate secret for an upstream API credential
+  - Create an agent gateway config for an upstream API
+  - Launch a devbox with one secret injected directly and the credential wired through agent gateway
+  - Verify the devbox can read MAGIC_NUMBER while the upstream API credential is replaced with gateway values
+  - Shutdown the devbox and delete the gateway config and both secrets
+tags:
+  - secrets
+  - devbox
+  - agent-gateway
+  - credentials
+  - environment-variables
+  - cleanup
+prerequisites:
+  - RUNLOOP_API_KEY
+run: uv run python -m examples.secrets_with_devbox
+test: uv run pytest -m smoketest tests/smoketests/examples/
+---
+"""
+
+from __future__ import annotations
+
+from runloop_api_client import RunloopSDK
+
+from ._harness import run_as_cli, unique_name, wrap_recipe
+from .example_types import ExampleCheck, RecipeOutput, RecipeContext
+
+# Note: do NOT hardcode secret values in your code!
+# This is example code only; use environment variables instead!
+_EXAMPLE_GATEWAY_ENDPOINT = "https://api.example.com"
+_UPSTREAM_CREDENTIAL_VALUE = "example-upstream-api-key"
+_MAGIC_NUMBER_VALUE = "42"
+
+
+def recipe(ctx: RecipeContext) -> RecipeOutput:
+    """Demonstrate direct secret injection for app data and agent gateway protection for upstream credentials."""
+    cleanup = ctx.cleanup
+
+    sdk = RunloopSDK()
+    resources_created: list[str] = []
+    checks: list[ExampleCheck] = []
+
+    magic_number_name = unique_name("magic-number-secret")
+    upstream_credential_name = unique_name("agent-gateway-secret")
+
+    magic_number_secret = sdk.secret.create(name=magic_number_name, value=_MAGIC_NUMBER_VALUE)
+    resources_created.append(f"secret:{magic_number_name}")
+    cleanup.add(f"secret:{magic_number_name}", magic_number_secret.delete)
+
+    magic_number_info = magic_number_secret.get_info()
+    checks.append(
+        ExampleCheck(
+            name="magic number secret created successfully",
+            passed=(magic_number_secret.name == magic_number_name and magic_number_info.id.startswith("sec_")),
+            details=f"name={magic_number_secret.name}, id={magic_number_info.id}",
+        )
+    )
+
+    upstream_credential_secret = sdk.secret.create(
+        name=upstream_credential_name,
+        value=_UPSTREAM_CREDENTIAL_VALUE,
+    )
+    resources_created.append(f"secret:{upstream_credential_name}")
+    cleanup.add(f"secret:{upstream_credential_name}", upstream_credential_secret.delete)
+
+    upstream_credential_info = upstream_credential_secret.get_info()
+    checks.append(
+        ExampleCheck(
+            name="upstream credential secret created successfully",
+            passed=(
+                upstream_credential_secret.name == upstream_credential_name
+                and upstream_credential_info.id.startswith("sec_")
+            ),
+            details=(f"name={upstream_credential_secret.name}, id={upstream_credential_info.id}"),
+        )
+    )
+
+    # Use direct secret injection when code inside the devbox legitimately needs
+    # the secret value at runtime. Use agent gateway for upstream credentials
+    # that should never be exposed to the agent.
+    gateway_config = sdk.gateway_config.create(
+        name=unique_name("agent-gateway-config"),
+        endpoint=_EXAMPLE_GATEWAY_ENDPOINT,
+        auth_mechanism={"type": "bearer"},
+        description="Example gateway that keeps upstream credentials off the devbox",
+    )
+    resources_created.append(f"gateway_config:{gateway_config.id}")
+    cleanup.add(f"gateway_config:{gateway_config.id}", gateway_config.delete)
+
+    gateway_info = gateway_config.get_info()
+    checks.append(
+        ExampleCheck(
+            name="gateway config created successfully",
+            passed=(gateway_info.id.startswith("gwc_") and gateway_info.endpoint == _EXAMPLE_GATEWAY_ENDPOINT),
+            details=f"id={gateway_info.id}, endpoint={gateway_info.endpoint}",
+        )
+    )
+
+    devbox = sdk.devbox.create(
+        name=unique_name("agent-gateway-devbox"),
+        secrets={
+            "MAGIC_NUMBER": magic_number_secret.name,
+        },
+        gateways={
+            "MY_API": {
+                "gateway": gateway_config.id,
+                "secret": upstream_credential_secret.name,
+            }
+        },
+        launch_parameters={
+            "resource_size_request": "X_SMALL",
+            "keep_alive_time_seconds": 60 * 5,
+        },
+    )
+    resources_created.append(f"devbox:{devbox.id}")
+    cleanup.add(f"devbox:{devbox.id}", devbox.shutdown)
+
+    devbox_info = devbox.get_info()
+    checks.append(
+        ExampleCheck(
+            name="devbox records gateway wiring",
+            passed=(
+                devbox_info.gateway_specs is not None
+                and devbox_info.gateway_specs.get("MY_API") is not None
+                and devbox_info.gateway_specs["MY_API"].gateway_config_id == gateway_config.id
+            ),
+            details=(
+                f"gateway_config_id={devbox_info.gateway_specs['MY_API'].gateway_config_id}"
+                if devbox_info.gateway_specs is not None and devbox_info.gateway_specs.get("MY_API") is not None
+                else "gateway spec missing"
+            ),
+        )
+    )
+
+    magic_number_result = devbox.cmd.exec("echo $MAGIC_NUMBER")
+    magic_number = magic_number_result.stdout().strip()
+    checks.append(
+        ExampleCheck(
+            name="devbox receives plain secret when app needs the value",
+            passed=(magic_number_result.exit_code == 0 and magic_number == _MAGIC_NUMBER_VALUE),
+            details=(f"exit_code={magic_number_result.exit_code}, MAGIC_NUMBER={magic_number}"),
+        )
+    )
+
+    url_result = devbox.cmd.exec("echo $MY_API_URL")
+    gateway_url = url_result.stdout().strip()
+    checks.append(
+        ExampleCheck(
+            name="devbox receives gateway URL",
+            passed=url_result.exit_code == 0 and gateway_url.startswith("http"),
+            details=f"exit_code={url_result.exit_code}, url={gateway_url}",
+        )
+    )
+
+    token_result = devbox.cmd.exec("echo $MY_API")
+    gateway_token = token_result.stdout().strip()
+    checks.append(
+        ExampleCheck(
+            name="devbox receives gateway token instead of raw secret",
+            passed=(
+                token_result.exit_code == 0
+                and gateway_token.startswith("gws_")
+                and gateway_token != _UPSTREAM_CREDENTIAL_VALUE
+            ),
+            details=(f"exit_code={token_result.exit_code}, token_prefix={gateway_token[:4] or 'missing'}"),
+        )
+    )
+
+    return RecipeOutput(resources_created=resources_created, checks=checks)
+
+
+run_secrets_with_devbox_example = wrap_recipe(recipe)
+
+
+if __name__ == "__main__":
+    run_as_cli(run_secrets_with_devbox_example)

{runloop_api_client-1.12.1 → runloop_api_client-1.13.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "runloop_api_client"
-version = "1.12.1"
+version = "1.13.1"
 description = "The official Python library for the runloop API"
 dynamic = ["readme"]
 license = "MIT"