snowflake-sandbox-python 0.2.2a2__py3-none-any.whl → 0.2.2a4__py3-none-any.whl

snowflake/cli_sandbox/_egress_flags.py

@@ -106,7 +106,12 @@ def build_egress(
 
     egress = Egress(
         external_access_integrations=integrations,
-        **({"allow_default_egress": False} if no_default_egress else {}),
+        # Uses the current parameter name. The CLI FLAG stays `--no-default-egress`: it is
+        # released, renaming it would break users' scripts, and that is a separate decision
+        # from the library parameter's name. So the flag spelling and the parameter spelling
+        # differ here deliberately — the alternative is the CLI depending on a deprecated
+        # parameter, which is worse.
+        **({"allow_public_package_registries": False} if no_default_egress else {}),
     )
     # Validate now, not at create time. `compile_egress` is pure and is what the client
     # runs anyway -- but it runs *after* connecting, so a mistyped host pair otherwise

snowflake/cli_sandbox/_run_command.py

@@ -312,7 +312,13 @@ def _print_inferred_plan(plan: _RunPlan) -> None:
     typer.echo(f"command:    {plan.command or '(image default)'}")
     if plan.egress is not None:
         eais = getattr(plan.egress, "external_access_integrations", ())
-        closed = getattr(plan.egress, "allow_default_egress", None) is False
+        # Read the RESOLVER, not any one spelling. There are three accepted names for this
+        # control and reading a specific field goes silently blind when a caller (or this
+        # CLI) uses a different one — which is exactly what happened: switching the flag's
+        # construction to allow_public_package_registries made this summary stop reporting
+        # "default-egress=closed" while the sandbox was still correctly closed. A dry run
+        # that under-reports the egress posture is worse than no dry run.
+        closed = getattr(plan.egress, "default_egress_allowed", None) is False
         bits = [f"eai={','.join(eais)}" if eais else "", "default-egress=closed" if closed else ""]
         if plan.secrets:
             bits.append(f"secrets={len(plan.secrets)}")

snowflake/sandbox/_diagnostics.py

@@ -127,19 +127,19 @@ def preflight_checks(spec: DeploySpec, bundle_root: Path | None = None) -> list[
         problems.append(Problem("error", str(exc)))
 
     # A secret's `host` and Snowflake reachability are different controls: the first is
-    # enforced at the credential swap, the second by allow_internet / the group
-    # booleans. A secret scoped to a host the sandbox cannot reach on Snowflake is
+    # enforced at the credential swap, the second by the egress level
+    # (allow_public_package_registries) / the group booleans. A secret scoped to a host the sandbox cannot reach on Snowflake is
     # silently useless, so say so. (eai_hosts is the SPCS perimeter and does not
     # affect Snowflake reachability, so it is deliberately not consulted here.)
     # Only warn when egress was *explicitly* closed AND no EAI was granted:
-    #   - allow_internet is tri-state: left unset the platform applies its permissive
+    #   - the egress level is tri-state: left unset the platform applies its permissive
     #     default, and actual reachability is then an Istio question we cannot answer
     #     from here — warning on it would be noise on the common path.
     #   - allow_github / allow_pypi are NOT credited here, and now never could be: both
     #     are inert, so neither makes a host reachable in any mode. The retired
     #     allowed_egress_hosts is likewise not consulted — hosts named there are ignored
     #     platform-side.
-    #   - Under allow_internet=False the only grant left is an EAI, whose network rules
+    #   - Under allow_public_package_registries=False the only grant left is an EAI, whose rules
     #     live in Snowflake and cannot be resolved from here — so an EAI being present is
     #     taken as "the caller has said how" (loop-invariant, hence hoisted out below).
     eg = spec.egress
@@ -153,13 +153,15 @@ def preflight_checks(spec: DeploySpec, bundle_root: Path | None = None) -> list[
                 hint = (
                     f"grant {h!r} with an External Access Integration and pass "
                     f'external_access_integrations=("MY_EAI",) — under '
-                    f"allow_internet=False that is the only grant the platform applies"
+                    f"allow_public_package_registries=False that is the only grant the "
+                    f"platform applies"
                 )
                 problems.append(
                     Problem(
                         "warn",
                         f"secret {s.fqn!r} is scoped to host {h!r}, which the sandbox cannot "
-                        f"reach with allow_internet=False — the credential could never be used",
+                        f"reach with allow_public_package_registries=False — the credential "
+                        f"could never be used",
                         hint,
                     )
                 )

snowflake/sandbox/_version.py

@@ -29,7 +29,7 @@ __all__ = ["__version__"]
 _DIST_NAME = "snowflake-sandbox-python"
 
 # Keep in sync with [project].version in pyproject.toml.
-_FALLBACK_VERSION = "0.2.2a2"
+_FALLBACK_VERSION = "0.2.2a4"
 
 try:
     __version__: str = _pkg_version(_DIST_NAME)

snowflake/sandbox/_wire.py

@@ -15,6 +15,7 @@ from collections.abc import Mapping, Sequence
 from datetime import timedelta
 from typing import TYPE_CHECKING, Any, get_args
 
+from snowflake.sandbox._runtime._protocol import _REPLY_SENTINEL, _RESULT_SENTINEL
 from snowflake.sandbox.exceptions import SandboxContractWarning, SandboxError
 from snowflake.sandbox.types import MemoryTier, SandboxStatus
 
@@ -23,6 +24,10 @@ if TYPE_CHECKING:
 
 __all__ = [
     "_parse_status",
+    "_is_internal_sentinel_line",
+    "_visible_log_lines",
+    "_logs_overfetch",
+    "_LOGS_OVERFETCH_CAP",
     "_warn_if_truncated",
     "_exec_session_id",
     "_resolve_exec_budget",
@@ -428,3 +433,58 @@ def _exec_reconnect_exhausted(attempt: int, *, delivered: bool) -> bool:
     never trips this.
     """
     return not delivered and attempt >= len(_EXEC_RECONNECT_DELAYS)
+
+
+# --- internal protocol lines that must never reach a caller's logs() -------------
+#
+# The in-sandbox runner and session daemon report over STDOUT, so their markers land in
+# the log stream alongside the workload's own output: `__SANDBOX_RESULT__<b64>` on
+# managed-process exit and `__SANDBOX_REPLY__<...>` per session reply. They are transport,
+# not output -- `logs()` suppressing them is what LogStream already does for the result
+# marker ("suppress the internal marker from output").
+#
+# They CANNOT be stripped server-side: they are an SDK-level protocol the API knows
+# nothing about, and `_protocol.py` calls their values a compatibility surface (a sandbox
+# launched by an older SDK is still running the older wrapper text), so the wrapper cannot
+# stop printing them either. Internal consumers therefore read the UNFILTERED text via
+# `_logs_raw()`; only the public `logs()` filters.
+_INTERNAL_SENTINELS = (_RESULT_SENTINEL, _REPLY_SENTINEL)
+
+# How many extra lines to ask the server for when a caller wants the last `tail` VISIBLE
+# lines. `tail` is applied SERVER-side, before filtering, so asking for exactly `tail`
+# and then dropping a sentinel returns fewer lines than requested -- the bug that made
+# logs(tail=2) answer ['line5', '__SANDBOX_RESULT__...'] and then, once filtered,
+# ['line5'] alone. The fetch grows until enough visible lines come back, the server runs
+# out of log, or the cap is hit; the cap keeps a session whose recent history is mostly
+# reply markers from turning one logs() call into an unbounded fetch.
+_LOGS_OVERFETCH_MARGIN = 8
+_LOGS_OVERFETCH_CAP = 4096
+
+
+def _is_internal_sentinel_line(text: str) -> bool:
+    """True when a log line carries an SDK-internal protocol marker."""
+    return any(sentinel in text for sentinel in _INTERNAL_SENTINELS)
+
+
+def _visible_log_lines(raw_text: str) -> list[str]:
+    r"""The caller-visible lines of a raw log snapshot, internal markers removed.
+
+    An empty snapshot yields no lines rather than one empty line, so
+    ``"\n".join(...)`` round-trips "" instead of inventing a blank line.
+    """
+    if not raw_text:
+        return []
+    return [ln for ln in raw_text.split("\n") if not _is_internal_sentinel_line(ln)]
+
+
+def _logs_overfetch(tail: int, previous: int = 0) -> int:
+    """Server-side `tail` to request in order to end up with `tail` VISIBLE lines.
+
+    `tail=0` means "everything", which needs no widening. Otherwise start a margin above
+    the request and double on each retry, capped -- see `_LOGS_OVERFETCH_CAP`.
+    """
+    if tail <= 0:
+        return 0
+    if previous <= 0:
+        return tail + _LOGS_OVERFETCH_MARGIN
+    return min(previous * 2, _LOGS_OVERFETCH_CAP)

snowflake/sandbox/client.py

@@ -57,6 +57,7 @@ from snowflake.sandbox._transport import (
 from snowflake.sandbox._wire import (
     _EXEC_RECONNECT_DELAYS,
     _EXEC_TIMEOUT_GRACE_S,
+    _LOGS_OVERFETCH_CAP,
     _POLL_UNKNOWN_EXIT_CODE,
     _PROBE_BUDGET_S,
     _PROBE_NOT_FOUND_RETRY_S,
@@ -66,8 +67,10 @@ from snowflake.sandbox._wire import (
     _exec_session_id,
     _fresh_exec_body,
     _idle_suspend_minutes,
+    _logs_overfetch,
     _parse_status,
     _resolve_exec_budget,
+    _visible_log_lines,
     _warn_if_truncated,
 )
 from snowflake.sandbox.egress import Egress, compile_egress
@@ -129,7 +132,7 @@ async def _coerce_image(image: str | Image, transport: Transport | None) -> str:
 
 
 class AsyncSandbox(_FilesMixin, _SandboxState):
-    """A Snowflake sandbox container (async API).
+    """A Cortex Sandbox (async API).
 
     ``await create()`` is the factory, and the only creation path -- ``AsyncSandbox(...)``
     raises. A constructor cannot be awaited, which is the deeper reason it was never the
@@ -766,15 +769,69 @@ class AsyncSandbox(_FilesMixin, _SandboxState):
             return
         await self._wait_until_ready(timeout=timeout)
 
-    async def logs(self, *, tail: int = 0, since_ts_ms: int = 0) -> str:
+    async def logs(
+        self, *, tail: int = 0, since_ts_ms: int = 0, source: str | None = None, pid: int = 0
+    ) -> str:
         """Return the container's captured stdout and stderr as a string.
 
         `tail` limits to the last N lines. Only meaningful for command containers
         (created with `command=`).
 
+        `source` selects which stream to read, defaulting to the server's `all` -- the
+        entrypoint plus the `command=` process:
+
+        - ``"exec"`` -- what the commands you ran with `exec()` printed, which no other
+          source includes. `exec()` also returns that output directly; this is how you
+          read it again afterwards.
+        - ``"base"`` / ``"managed"`` -- one of the two long-lived streams on its own.
+
+        `pid` narrows an exec read to one producer. Without it every exec is merged and
+        the returned text carries no per-line attribution; `pid=` is how you read one
+        command's output on its own.
+
+        SDK-internal protocol markers are suppressed: the in-sandbox runner reports a
+        run's outcome as `__SANDBOX_RESULT__<b64>` on stdout and the session daemon
+        reports replies as `__SANDBOX_REPLY__<...>`, so both land in the log stream
+        beside the workload's own output. They are transport, not output. `tail` counts
+        VISIBLE lines, so `logs(tail=2)` on a command printing `line1..line5` answers the two
+        lines `line4` and `line5`, never spending one of the two on a marker.
+
         Example:
             output = await sb.logs(tail=100)
             print(output)
+
+            # What the commands you ran with `exec()` printed.
+            print(await sb.logs(source="exec"))
+        """
+        fetch = _logs_overfetch(tail)
+        while True:
+            raw = await self._logs_raw(tail=fetch, since_ts_ms=since_ts_ms, source=source, pid=pid)
+            raw_count = len(raw.split("\n")) if raw else 0
+            visible = _visible_log_lines(raw)
+            if tail <= 0 or len(visible) >= tail:
+                break
+            # Short of `tail` visible lines. Only a WIDER fetch can help, and only while
+            # the server still has more to give: `raw_count < fetch` means we already hold
+            # the whole log, so filtering -- not the window -- is why there are fewer.
+            if raw_count < fetch or fetch >= _LOGS_OVERFETCH_CAP:
+                break
+            fetch = _logs_overfetch(tail, fetch)
+        # `tail > 0`, not `if tail`: a NEGATIVE tail is truthy and visible[-(-1):] is
+        # visible[1:], which would silently drop the FIRST lines instead of returning
+        # everything. `_logs_overfetch` already treats tail <= 0 as "no window".
+        if tail > 0:
+            visible = visible[-tail:]
+        return "\n".join(visible)
+
+    async def _logs_raw(
+        self, *, tail: int = 0, since_ts_ms: int = 0, source: str | None = None, pid: int = 0
+    ) -> str:
+        """The log snapshot EXACTLY as the server returns it, markers included.
+
+        Internal consumers that read the runner's or daemon's stdout protocol
+        (`wait()`, `Job.get`/`Job.status`, `send()`) must use this, not `logs()` --
+        `logs()` strips the very lines they parse. Not public: a caller wanting the
+        sandbox's output wants `logs()`.
         """
         if not self._created:
             await self._ensure_created()
@@ -787,6 +844,14 @@ class AsyncSandbox(_FilesMixin, _SandboxState):
             q.append(f"tail={tail}")
         if since_ts_ms:
             q.append(f"since={since_ts_ms}")
+        # Forwarded verbatim rather than validated here: the server owns the vocabulary
+        # and names the valid values in its rejection, so a client-side allowlist would go
+        # stale as soon as a source is added and would turn a 400 that explains itself
+        # into one that does not.
+        if source:
+            q.append(f"source={source}")
+        if pid:
+            q.append(f"pid={pid}")
         path = f"containers/{self._id}/logs" + ("?" + "&".join(q) if q else "")
         try:
             resp = await self._transport.request(
@@ -1852,7 +1917,7 @@ class AsyncSandbox(_FilesMixin, _SandboxState):
             # it (the connect() reconnect path) fall through to the server-reported
             # exit code rather than accepting a forgeable, unauthenticated line.
             if self._result_nonce is not None:
-                parsed = _parse_result_sentinel(await self.logs(), nonce=self._result_nonce)
+                parsed = _parse_result_sentinel(await self._logs_raw(), nonce=self._result_nonce)
                 if parsed is not None:
                     parsed.logs_ref = self._id
                     return parsed
@@ -1910,7 +1975,7 @@ class AsyncSandbox(_FilesMixin, _SandboxState):
         await self.exec(_mailbox_append_cmd(msg_id, message))
         deadline = _time.monotonic() + timeout
         while True:
-            reply = _parse_reply_sentinel(await self.logs(), msg_id, nonce=self._reply_nonce)
+            reply = _parse_reply_sentinel(await self._logs_raw(), msg_id, nonce=self._reply_nonce)
             if reply is not None:
                 return reply
             # A terminal container will never reply; surface that rather than spending
@@ -1918,7 +1983,9 @@ class AsyncSandbox(_FilesMixin, _SandboxState):
             # the cached status) is the only live read of the container's lifecycle.
             if await self.refresh() in TERMINAL_STATUSES:
                 # One last read: the daemon may have replied just before exiting.
-                reply = _parse_reply_sentinel(await self.logs(), msg_id, nonce=self._reply_nonce)
+                reply = _parse_reply_sentinel(
+                    await self._logs_raw(), msg_id, nonce=self._reply_nonce
+                )
                 if reply is not None:
                     return reply
                 raise SandboxError(_ended_before_reply(self.status, msg_id))

snowflake/sandbox/connect.py

@@ -251,7 +251,7 @@ def _make_connection(**kwargs: Any) -> Any:
 
 
 def get_snowflake_connection(**kwargs: Any) -> Any:
-    """Return a Snowflake connection for code running inside a Snowflake sandbox.
+    """Return a Snowflake connection for code running inside a Cortex Sandbox.
 
     Resolves the credential the way the platform provides it, in order: the
     ``SNOWFLAKE_PAT``/``SNOWFLAKE_TOKEN`` env value; a token file named by

snowflake/sandbox/egress.py

@@ -48,7 +48,7 @@ def _retired_host_list_message(spelling: str) -> str:
         f"locally instead: the sandbox would start healthy and silently fail to reach "
         f"them.\n\n"
         f"Grant the hosts with an External Access Integration and name it instead:\n"
-        f'    Egress(allow_default_egress=False, external_access_integrations=("MY_EAI",))\n\n'
+        f'    Egress(allow_public_package_registries=False, external_access_integrations=("MY_EAI",))\n\n'
         f"Creating one (the network rule cannot live in a personal USER$ database):\n"
         f"    CREATE NETWORK RULE db.schema.my_rule MODE = EGRESS TYPE = HOST_PORT\n"
         f"        VALUE_LIST = ('example.com:443');\n"
@@ -71,11 +71,30 @@ def _nonempty_host_value(raw: object) -> bool:
     return len(raw) > 0
 
 
-# The REST spelling of the default-egress tri-state. Named once: the SDK parameter was
-# renamed to allow_default_egress, the wire key was not, and two places translate between
-# them (Egress.to_wire and compile_egress's raw-dict path).
+# The REST spelling this client SENDS for the egress tri-state. Named once because the
+# client parameter and the wire key have diverged and two places translate between them
+# (Egress.to_wire and compile_egress's raw-dict path).
+#
+# DELIBERATELY still "allow_internet", even though sandbox-api now has
+# allow_public_package_registries (sandbox-api#349) and every tier accepts it (measured
+# 2026-09-24). Do NOT "fix" this to the new key as a tidy-up — that couples a client-side
+# naming improvement to a deployment risk:
+#
+#   - sandbox-api keeps honouring allow_internet deliberately, for pinned SDKs exactly like
+#     this one (containers/egress.go: "the superseded one and still means exactly the same
+#     thing"; containers/models.go names "every pinned sandbox-sdk" as the reason).
+#   - A prod rollback to a pre-#349 build would 400 every create carrying the NEW key, while
+#     the old key keeps working against every build, reverted or not.
+#
+# Switching it is its own decision, gated on the prod rollback window closing — not on the
+# field being accepted. Until then this is the one spelling that is safe everywhere.
 _DEFAULT_EGRESS_WIRE_KEY = "allow_internet"
 
+# The current, honest client parameter name; it matches sandbox-api's field and the Snowsight
+# dialog copy ("Snowflake and public package registries"). The two older spellings below stay
+# accepted because they shipped.
+_EGRESS_LEVEL_PARAM = "allow_public_package_registries"
+
 
 @dataclass(frozen=True)
 class Egress:
@@ -87,8 +106,8 @@ class Egress:
 
     | level | how | reaches |
     |---|---|---|
-    | baseline | the default, or `allow_default_egress=True` | Snowflake, the cloud-storage stages, and ~43 package-manager hosts |
-    | closed | `allow_default_egress=False` / `Egress.only()` | Snowflake and its stages only |
+    | baseline | the default, or `allow_public_package_registries=True` | Snowflake, the cloud-storage stages, and ~43 package-manager hosts |
+    | closed | `allow_public_package_registries=False` / `Egress.only()` | Snowflake and its stages only |
     | granted | `external_access_integrations=(...)` | the above, plus whatever the EAI's network rules resolve to |
 
     **The baseline is not the internet.** It is a curated host set the platform
@@ -96,17 +115,30 @@ class Egress:
     list requires an External Access Integration whichever level you pick. A
     caller-supplied host list used to be the third option and is now retired.
 
-    `allow_internet` is the former name of `allow_default_egress` and still works, with a
-    DeprecationWarning. It was misleading in both directions: it never granted the whole
-    internet, and False does not stop egress because an EAI still grants.
+    **The parameter is `allow_public_package_registries`.** Two earlier spellings still work
+    and are deprecated — `allow_default_egress` and, before it, `allow_internet`. Setting more
+    than one to *different* values raises, since they are one control.
+
+    Neither older name survived contact with what the field does. `allow_internet` was wrong
+    in both directions: it never granted the internet (the baseline is a curated ~43-host set,
+    GET/HEAD only), and `False` does not stop egress because an EAI still grants.
+    `allow_default_egress` then named the value's *provenance* rather than what it grants, and
+    self-contradicts the moment the platform default changes — at which point
+    `default_egress=False` would *be* the default. The current name says what is granted.
+
+    Neither older name emits a DeprecationWarning yet. That is deliberate and not an
+    oversight: the warning would fire on construction, so adding it means migrating every
+    test and example that still uses an old name, for no behaviour change. It arrives with the
+    release that removes them.
 
     Example:
         egress = Egress()                                # baseline
         egress = Egress.only()                           # closed: nothing arbitrary
-        egress = Egress(allow_default_egress=False, external_access_integrations=("MY_EAI",))
+        egress = Egress(allow_public_package_registries=False,
+                        external_access_integrations=("MY_EAI",))
 
-    `allow_github` and `allow_pypi` are both **deprecated and inert**. `allow_internet` is
-    the only egress control. Public PyPI is already reachable via the package-managers
+    `allow_github` and `allow_pypi` are both **deprecated and inert**; the egress level is the
+    only control that does anything. Public PyPI is already reachable via the package-managers
     group, and the six GitHub/dbt hosts now need an External Access Integration like any
     other host outside that group. Both flags will be removed in a future release.
     """
@@ -118,8 +150,8 @@ class Egress:
     # baseline and disables the group flags below.
     allow_internet: bool | None = None
     # Deprecated and inert. It set EgressConfig.allow_egress_to_github_and_dbt, the six-host
-    # GitHub/dbt group, which the platform is removing — leaving allow_internet as the only
-    # egress control. Those hosts need an External Access Integration now. Setting it does
+    # GitHub/dbt group, which the platform is removing — leaving the egress level as the only
+    # control. Those hosts need an External Access Integration now. Setting it does
     # nothing and, unlike allow_pypi, does not even warn (see __new__); to_wire() no longer
     # sends it. Retained and still defaulting True, so existing callers keep constructing
     # without a TypeError and no value of it reads as meaningful; remove in a later major.
@@ -139,7 +171,25 @@ class Egress:
     # replaces. Appended last so positional Egress(None, True, False, (...)) callers are
     # unaffected. The WIRE key is still allow_internet — this is a client-side rename, so
     # no server change is needed and old and new SDKs interoperate.
+    #
+    # SUPERSEDED by allow_public_package_registries below. Kept working, not removed: it
+    # shipped in v0.2.1a1 / v0.2.2.dev1 / v0.2.2a2 / v0.2.2a3, so deleting it would break
+    # callers who adopted it.
     allow_default_egress: bool | None = None
+    # The current name, and the one to use. Matches sandbox-api's request field
+    # (allow_public_package_registries, sandbox-api#349) and the Snowsight dialog's wording,
+    # so the client, the wire contract and the UI finally agree on what this knob is called.
+    #
+    # Why the two names above are not it. "internet" was wrong in both directions: it never
+    # granted the internet (the baseline is ~43 curated hosts, GET/HEAD only) and False does
+    # not stop egress, because an EAI still grants. "default egress" then described the
+    # value's PROVENANCE rather than what it grants, and self-contradicts the moment the
+    # platform default changes — at which point "default_egress=False" would BE the default.
+    # This name says what is actually granted: access to public package registries.
+    #
+    # Appended last so positional Egress(None, True, False, (...), None) callers are
+    # unaffected. Tri-state exactly like the fields it supersedes.
+    allow_public_package_registries: bool | None = None
 
     def __post_init__(self) -> None:
         # A dataclass enforces no types, so Egress(allow_internet="false") kept the string and
@@ -148,6 +198,7 @@ class Egress:
         for name, nullable in (
             ("allow_internet", True),
             ("allow_default_egress", True),
+            ("allow_public_package_registries", True),
             ("allow_github", False),
             ("allow_pypi", False),
         ):
@@ -158,17 +209,21 @@ class Egress:
                 raise SandboxError(
                     f"Egress({name}=) must be True or False, got {type(value).__name__} {value!r}"
                 )
-        # Both spellings set and disagreeing is ambiguous, and picking one silently would
+        # Any two spellings set and disagreeing is ambiguous, and picking one silently would
         # apply an egress posture the caller did not ask for. Raise at the call instead.
-        if (
-            self.allow_internet is not None
-            and self.allow_default_egress is not None
-            and self.allow_internet != self.allow_default_egress
-        ):
+        # Checked pairwise across all THREE names, not just the newest pair: a caller
+        # mid-migration can easily have the oldest and newest both set.
+        spellings = [
+            ("allow_public_package_registries", self.allow_public_package_registries),
+            ("allow_default_egress", self.allow_default_egress),
+            ("allow_internet", self.allow_internet),
+        ]
+        given = [(n, v) for n, v in spellings if v is not None]
+        if len({v for _, v in given}) > 1:
+            shown = ", ".join(f"{n}={v!r}" for n, v in given)
             raise SandboxError(
-                "Egress(allow_internet=) and Egress(allow_default_egress=) disagree "
-                f"({self.allow_internet!r} vs {self.allow_default_egress!r}). They are the "
-                "same control — pass only allow_default_egress."
+                f"Egress spellings of the egress level disagree ({shown}). They are all the "
+                f"same control — pass only {_EGRESS_LEVEL_PARAM}."
             )
         # NOT warned on deliberately. The suite runs filterwarnings=error, so emitting a
         # DeprecationWarning here fails all 21 tests that construct Egress(allow_internet=)
@@ -194,7 +249,8 @@ class Egress:
     def only() -> Egress:
         """Close egress — ``Egress.only()``, with no arguments.
 
-        Sets ``allow_default_egress=False``, which withholds the platform baseline as well: no
+        Sets ``allow_public_package_registries=False``, which withholds the platform baseline as
+        well: no
         arbitrary internet host is reachable, not even the package-manager set the default
         mode grants. Snowflake and its stages stay reachable regardless — see the danger
         note below, which is why this is not described as total confinement.
@@ -203,7 +259,7 @@ class Egress:
         caller-supplied host list; to confine and then grant a specific host, pair
         confinement with an External Access Integration:
 
-            Egress(allow_default_egress=False, external_access_integrations=("MY_EAI",))
+            Egress(allow_public_package_registries=False, external_access_integrations=("MY_EAI",))
 
         !!! danger "Not an exfiltration boundary for Snowflake destinations"
             ``only()`` does **not** confine the sandbox to *just* a chosen set of hosts.
@@ -220,9 +276,9 @@ class Egress:
             restriction. See *Reachability is not credential scope* above and the
             ``Secret`` docs.
         """
-        # New spelling deliberately: only() must not emit a DeprecationWarning at a
-        # caller who never touched the old name.
-        return Egress(allow_default_egress=False)
+        # Current spelling deliberately: only() must not attribute a deprecated name to a
+        # caller who never typed one.
+        return Egress(allow_public_package_registries=False)
 
     @property
     def default_egress_allowed(self) -> bool | None:
@@ -232,6 +288,8 @@ class Egress:
         look "unset" to logic that checks the old one, which is the bug a plain alias
         would introduce.
         """
+        if self.allow_public_package_registries is not None:
+            return self.allow_public_package_registries
         if self.allow_default_egress is not None:
             return self.allow_default_egress
         return self.allow_internet
@@ -246,7 +304,11 @@ class Egress:
         if effective is not None:
             # Sent even when False: the platform reads an absent key as its permissive
             # default, so omitting it would silently discard a request to close egress.
-            # The key stays allow_internet — the rename is client-side only.
+            #
+            # EXACTLY ONE spelling goes on the wire. sandbox-api refuses a request carrying
+            # two spellings that disagree (containers/egress.go), so a client that sent both
+            # could produce a refusal that reads as a server bug. See
+            # _DEFAULT_EGRESS_WIRE_KEY for why that one spelling is still allow_internet.
             body[_DEFAULT_EGRESS_WIRE_KEY] = effective
         # Neither group flag is sent: the platform is removing the GitHub/dbt flag and already
         # reserved the one allow_pypi fed, so either would describe a grant that never happens.
@@ -302,8 +364,10 @@ def compile_egress(
     the two now coincide: the only meaningful field is the default-egress tri-state, whose
     default is the platform's own, so a default `Egress` serialises to nothing. A dict is
     taken as authored, since that path is the raw-wire escape hatch — except that
-    ``allow_default_egress`` is translated to the wire key, because a raw-dict caller who
-    used the name the docs now teach would otherwise have it silently ignored.
+    ``allow_public_package_registries`` and the older ``allow_default_egress`` are both
+    translated to the single wire key this client sends, because a raw-dict caller who used
+    the name the docs teach would otherwise have it silently ignored — and because sandbox-api
+    refuses a request that carries two disagreeing spellings of the same control.
     """
     if isinstance(egress, Egress):
         body = egress.to_wire()
@@ -312,18 +376,28 @@ def compile_egress(
     else:
         body = dict(egress)
         # A raw dict is otherwise passed through verbatim, which would make
-        # {"allow_default_egress": False} a silent no-op: the server sees no
-        # allow_internet key and applies its PERMISSIVE default, so a caller asking to
-        # close egress would get the baseline instead. Translate to the wire key rather
-        # than refuse, matching what the typed path accepts.
-        if "allow_default_egress" in body:
-            renamed = body.pop("allow_default_egress")
+        # {"allow_public_package_registries": False} or {"allow_default_egress": False} a
+        # silent no-op ON A CLIENT PATH THAT SENDS THE OLD KEY: the server would see no
+        # allow_internet key and apply its PERMISSIVE default, so a caller asking to close
+        # egress would get the baseline instead. Translate to the one wire key this client
+        # sends, rather than refuse, matching what the typed path accepts.
+        #
+        # EXACTLY ONE spelling may survive. sandbox-api refuses a request carrying two
+        # spellings that disagree, so collapsing them here turns a confusing server refusal
+        # into a local error naming the caller's own keys. Note allow_public_package_registries
+        # is BOTH a client name and a real wire key the server accepts — it is still collapsed
+        # onto _DEFAULT_EGRESS_WIRE_KEY so that one client cannot emit two spellings at once.
+        _level_aliases = ("allow_public_package_registries", "allow_default_egress")
+        for _alias in _level_aliases:
+            if _alias not in body:
+                continue
+            renamed = body.pop(_alias)
             existing = body.get(_DEFAULT_EGRESS_WIRE_KEY)
             if existing is not None and renamed is not None and existing != renamed:
                 raise SandboxError(
-                    f"egress dict sets both {_DEFAULT_EGRESS_WIRE_KEY!r} and "
-                    f"'allow_default_egress' to different values ({existing!r} vs "
-                    f"{renamed!r}). They are the same control — pass one."
+                    f"egress dict sets both {_DEFAULT_EGRESS_WIRE_KEY!r} and {_alias!r} to "
+                    f"different values ({existing!r} vs {renamed!r}). They are the same "
+                    f"control — pass one, and {_EGRESS_LEVEL_PARAM!r} is the current name."
                 )
             if renamed is not None:
                 body[_DEFAULT_EGRESS_WIRE_KEY] = renamed

snowflake/sandbox/jobs.py

@@ -211,7 +211,7 @@ class Job(_JobHandle):
         terminal state and server-reported exit code, never a forgeable line."""
         sb = await get_sandbox(self.id, connection=self._connection)
         if self.nonce is not None:
-            parsed = _parse_result_sentinel(await sb.logs(), nonce=self.nonce)
+            parsed = _parse_result_sentinel(await sb._logs_raw(), nonce=self.nonce)
             if parsed is not None:
                 # A trusted sentinel reports succeeded/failed; status() is a live
                 # lifecycle verdict where timed_out is not a member, so fold it in.
@@ -226,7 +226,8 @@ class Job(_JobHandle):
     async def get(self, timeout: float | None = None, poll_s: float = 3.0) -> RunResult:
         """Poll for the Job's result.
 
-        Fetches ``get_sandbox(id).logs()`` and scans for the LAST sentinel;
+        Fetches ``get_sandbox(id)._logs_raw()`` -- the UNFILTERED channel, because the
+        public ``logs()`` strips the very sentinel this scans for -- and takes the LAST one;
         returns the decoded `RunResult` as soon as one appears. If the
         container reaches a terminal state (``dead`` or ``failed``) with no sentinel, returns
         ``RunResult(status="failed", ...)``. On *timeout* (when set) before
@@ -239,7 +240,7 @@ class Job(_JobHandle):
             # Only trust the stdout sentinel when we hold the run's nonce;
             # a from_id() handle has none, so fall through to the server state.
             if self.nonce is not None:
-                parsed = _parse_result_sentinel(await sb.logs(), nonce=self.nonce)
+                parsed = _parse_result_sentinel(await sb._logs_raw(), nonce=self.nonce)
                 if parsed is not None:
                     parsed.logs_ref = self.id
                     return parsed
@@ -288,7 +289,7 @@ class SyncJob(_JobHandle):
         container's own terminal state."""
         sb = get_sandbox_sync(self.id, connection=self._connection)
         if self.nonce is not None:
-            parsed = _parse_result_sentinel(sb.logs(), nonce=self.nonce)
+            parsed = _parse_result_sentinel(sb._logs_raw(), nonce=self.nonce)
             if parsed is not None:
                 # See Job.status: fold the non-live timed_out into failed.
                 return "failed" if parsed.status == "timed_out" else parsed.status
@@ -308,7 +309,7 @@ class SyncJob(_JobHandle):
         while True:
             sb = get_sandbox_sync(self.id, connection=self._connection)
             if self.nonce is not None:
-                parsed = _parse_result_sentinel(sb.logs(), nonce=self.nonce)
+                parsed = _parse_result_sentinel(sb._logs_raw(), nonce=self.nonce)
                 if parsed is not None:
                     parsed.logs_ref = self.id
                     return parsed

snowflake/sandbox/log_stream.py

@@ -24,6 +24,7 @@ from collections.abc import AsyncIterator
 from typing import TYPE_CHECKING, Any, Self
 
 from snowflake.sandbox._runtime._protocol import _RESULT_SENTINEL
+from snowflake.sandbox._wire import _is_internal_sentinel_line
 from snowflake.sandbox.exceptions import SandboxConflictError, SandboxError
 from snowflake.sandbox.types import TERMINAL_STATUSES, StreamName
 
@@ -105,6 +106,13 @@ class LogStream(AsyncIterator[str]):
             if _RESULT_SENTINEL in text:
                 self._process_done = True
                 continue
+            # Any OTHER internal marker (the session daemon's __SANDBOX_REPLY__) is
+            # suppressed too, but is NOT end-of-stream -- a session keeps running after a
+            # reply. Checked after the result marker so that one still sets the flag.
+            # Without this the streamed view leaked a marker the snapshot logs() hides:
+            # same sandbox, two different answers about what its output was.
+            if _is_internal_sentinel_line(text):
+                continue
             ts = int(ln.get("ts") or 0)
             if ts:
                 # Compare against the batch-start watermark, not one mutated

snowflake/sandbox/sync_client.py

@@ -55,6 +55,7 @@ from snowflake.sandbox._sync_transport import (
 from snowflake.sandbox._wire import (
     _EXEC_RECONNECT_DELAYS,
     _EXEC_TIMEOUT_GRACE_S,
+    _LOGS_OVERFETCH_CAP,
     _POLL_UNKNOWN_EXIT_CODE,
     _PROBE_BUDGET_S,
     _PROBE_NOT_FOUND_RETRY_S,
@@ -64,8 +65,10 @@ from snowflake.sandbox._wire import (
     _exec_session_id,
     _fresh_exec_body,
     _idle_suspend_minutes,
+    _logs_overfetch,
     _parse_status,
     _resolve_exec_budget,
+    _visible_log_lines,
     _warn_if_truncated,
 )
 from snowflake.sandbox.egress import Egress, compile_egress
@@ -146,7 +149,7 @@ def _raise_if_stream_terminated(abort: StreamAbort) -> None:
 
 
 class Sandbox(_FilesMixin, _SandboxState):
-    """A Snowflake sandbox container (sync API).
+    """A Cortex Sandbox (sync API).
 
     `create()` is the factory, and the only creation path -- ``Sandbox(...)`` raises.
     Reconnect to an existing sandbox with ``Sandbox.connect(name)`` / `get_sandbox` /
@@ -765,15 +768,69 @@ class Sandbox(_FilesMixin, _SandboxState):
             return
         self._wait_until_ready(timeout=timeout)
 
-    def logs(self, *, tail: int = 0, since_ts_ms: int = 0) -> str:
+    def logs(
+        self, *, tail: int = 0, since_ts_ms: int = 0, source: str | None = None, pid: int = 0
+    ) -> str:
         """Return the container's captured stdout and stderr as a string.
 
         `tail` limits to the last N lines. Only meaningful for command containers
         (created with `command=`).
 
+        `source` selects which stream to read, defaulting to the server's `all` -- the
+        entrypoint plus the `command=` process:
+
+        - ``"exec"`` -- what the commands you ran with `exec()` printed, which no other
+          source includes. `exec()` also returns that output directly; this is how you
+          read it again afterwards.
+        - ``"base"`` / ``"managed"`` -- one of the two long-lived streams on its own.
+
+        `pid` narrows an exec read to one producer. Without it every exec is merged and
+        the returned text carries no per-line attribution; `pid=` is how you read one
+        command's output on its own.
+
+        SDK-internal protocol markers are suppressed: the in-sandbox runner reports a
+        run's outcome as `__SANDBOX_RESULT__<b64>` on stdout and the session daemon
+        reports replies as `__SANDBOX_REPLY__<...>`, so both land in the log stream
+        beside the workload's own output. They are transport, not output. `tail` counts
+        VISIBLE lines, so `logs(tail=2)` on a command printing `line1..line5` answers the two
+        lines `line4` and `line5`, never spending one of the two on a marker.
+
         Example:
             output = sb.logs(tail=100)
             print(output)
+
+            # What the commands you ran with `exec()` printed.
+            print(sb.logs(source="exec"))
+        """
+        fetch = _logs_overfetch(tail)
+        while True:
+            raw = self._logs_raw(tail=fetch, since_ts_ms=since_ts_ms, source=source, pid=pid)
+            raw_count = len(raw.split("\n")) if raw else 0
+            visible = _visible_log_lines(raw)
+            if tail <= 0 or len(visible) >= tail:
+                break
+            # Short of `tail` visible lines. Only a WIDER fetch can help, and only while
+            # the server still has more to give: `raw_count < fetch` means we already hold
+            # the whole log, so filtering -- not the window -- is why there are fewer.
+            if raw_count < fetch or fetch >= _LOGS_OVERFETCH_CAP:
+                break
+            fetch = _logs_overfetch(tail, fetch)
+        # `tail > 0`, not `if tail`: a NEGATIVE tail is truthy and visible[-(-1):] is
+        # visible[1:], which would silently drop the FIRST lines instead of returning
+        # everything. `_logs_overfetch` already treats tail <= 0 as "no window".
+        if tail > 0:
+            visible = visible[-tail:]
+        return "\n".join(visible)
+
+    def _logs_raw(
+        self, *, tail: int = 0, since_ts_ms: int = 0, source: str | None = None, pid: int = 0
+    ) -> str:
+        """The log snapshot EXACTLY as the server returns it, markers included.
+
+        Internal consumers that read the runner's or daemon's stdout protocol
+        (`wait()`, `Job.get`/`Job.status`, `send()`) must use this, not `logs()` --
+        `logs()` strips the very lines they parse. Not public: a caller wanting the
+        sandbox's output wants `logs()`.
         """
         if not self._created:
             self._ensure_created()
@@ -786,6 +843,14 @@ class Sandbox(_FilesMixin, _SandboxState):
             q.append(f"tail={tail}")
         if since_ts_ms:
             q.append(f"since={since_ts_ms}")
+        # Forwarded verbatim rather than validated here: the server owns the vocabulary
+        # and names the valid values in its rejection, so a client-side allowlist would go
+        # stale as soon as a source is added and would turn a 400 that explains itself
+        # into one that does not.
+        if source:
+            q.append(f"source={source}")
+        if pid:
+            q.append(f"pid={pid}")
         path = f"containers/{self._id}/logs" + ("?" + "&".join(q) if q else "")
         try:
             resp = self._transport.request("GET", path, retry_500_delays=DEFAULT_LOGS_500_DELAYS_S)
@@ -1801,7 +1866,7 @@ class Sandbox(_FilesMixin, _SandboxState):
             # it (the connect() reconnect path) fall through to the server-reported
             # exit code rather than accepting a forgeable, unauthenticated line.
             if self._result_nonce is not None:
-                parsed = _parse_result_sentinel(self.logs(), nonce=self._result_nonce)
+                parsed = _parse_result_sentinel(self._logs_raw(), nonce=self._result_nonce)
                 if parsed is not None:
                     parsed.logs_ref = self._id
                     return parsed
@@ -1858,7 +1923,7 @@ class Sandbox(_FilesMixin, _SandboxState):
         self.exec(_mailbox_append_cmd(msg_id, message))
         deadline = _time.monotonic() + timeout
         while True:
-            reply = _parse_reply_sentinel(self.logs(), msg_id, nonce=self._reply_nonce)
+            reply = _parse_reply_sentinel(self._logs_raw(), msg_id, nonce=self._reply_nonce)
             if reply is not None:
                 return reply
             # A terminal container will never reply; surface that rather than spending
@@ -1866,7 +1931,7 @@ class Sandbox(_FilesMixin, _SandboxState):
             # the cached status) is the only live read of the container's lifecycle.
             if self.refresh() in TERMINAL_STATUSES:
                 # One last read: the daemon may have replied just before exiting.
-                reply = _parse_reply_sentinel(self.logs(), msg_id, nonce=self._reply_nonce)
+                reply = _parse_reply_sentinel(self._logs_raw(), msg_id, nonce=self._reply_nonce)
                 if reply is not None:
                     return reply
                 raise SandboxError(_ended_before_reply(self.status, msg_id))

snowflake/sandbox/sync_log_stream.py

@@ -23,6 +23,7 @@ from collections.abc import Iterator
 from typing import TYPE_CHECKING, Self
 
 from snowflake.sandbox._runtime._protocol import _RESULT_SENTINEL
+from snowflake.sandbox._wire import _is_internal_sentinel_line
 from snowflake.sandbox.log_stream import (
     _DRAIN_AFTER_TERMINAL_S,
     _POLL_INTERVAL_S,
@@ -90,6 +91,13 @@ class SyncLogStream(Iterator[str]):
             if _RESULT_SENTINEL in text:
                 self._process_done = True
                 continue
+            # Any OTHER internal marker (the session daemon's __SANDBOX_REPLY__) is
+            # suppressed too, but is NOT end-of-stream -- a session keeps running after a
+            # reply. Checked after the result marker so that one still sets the flag.
+            # Without this the streamed view leaked a marker the snapshot logs() hides:
+            # same sandbox, two different answers about what its output was.
+            if _is_internal_sentinel_line(text):
+                continue
             ts = int(ln.get("ts") or 0)
             if ts:
                 if ts < start_ts:

snowflake/sandbox/warm_session.py

@@ -28,7 +28,8 @@ redeployed, never adopted — see `agent_session`.
 
 * `Session.send()` mints a ``msg_id`` (uuid hex), execs a shell-quoted
   ``printf … >> /var/tmp/sandbox_mailbox.jsonl`` to append the message, then polls
-  ``logs()`` until the matching ``__SANDBOX_REPLY__<msg_id>__<b64>`` line
+  ``_logs_raw()`` -- the UNFILTERED channel, since the public ``logs()`` suppresses
+  internal markers -- until the matching ``__SANDBOX_REPLY__<msg_id>__<b64>`` line
   appears, base64-decodes it, and returns the reply string. A timeout raises
   `SandboxExecTimeoutError`.
 
@@ -304,7 +305,8 @@ class Session:
 
         Mints a ``msg_id``, execs a shell-quoted append into
         ``/var/tmp/sandbox_mailbox.jsonl`` inside the live container, then polls
-        ``logs()`` until the daemon prints ``__SANDBOX_REPLY__<msg_id>__<b64>``.
+        ``_logs_raw()`` (the unfiltered channel; public ``logs()`` hides the marker)
+        until the daemon prints ``__SANDBOX_REPLY__<msg_id>__<b64>``.
         Base64-decodes the payload and returns the reply string.
 
         Raises `SandboxError` if the container reaches a terminal state without
@@ -316,7 +318,7 @@ class Session:
 
         deadline = time.monotonic() + timeout
         while True:
-            log_text = await sb.logs()
+            log_text = await sb._logs_raw()
             reply = _parse_reply_sentinel(log_text, msg_id, nonce=self.nonce)
             if reply is not None:
                 return reply
@@ -327,7 +329,7 @@ class Session:
             if await sb.refresh() in TERMINAL_STATUSES:
                 # One last read first -- the daemon may have replied just before
                 # exiting, and that reply is the answer, not an error.
-                reply = _parse_reply_sentinel(await sb.logs(), msg_id, nonce=self.nonce)
+                reply = _parse_reply_sentinel(await sb._logs_raw(), msg_id, nonce=self.nonce)
                 if reply is not None:
                     return reply
                 raise SandboxError(_ended_before_reply(sb.status, msg_id))
@@ -342,7 +344,8 @@ class Session:
         Same mailbox round-trip as `send`, blocking instead of awaiting: mints a
         ``msg_id``, execs the shell-quoted append into
         ``/var/tmp/sandbox_mailbox.jsonl`` inside the live container (via the
-        synchronous `Sandbox`), then polls ``logs()`` until the daemon prints
+        synchronous `Sandbox`), then polls ``_logs_raw()`` -- the unfiltered channel,
+        since public ``logs()`` hides the marker -- until the daemon prints
         ``__SANDBOX_REPLY__<msg_id>__<b64>``, base64-decodes it, and returns the
         reply string. The request built and the reply parsed are byte-identical
         to `send`'s — both go through the shared ``_mailbox_append_cmd`` /
@@ -365,14 +368,14 @@ class Session:
 
         deadline = time.monotonic() + timeout
         while True:
-            log_text = sb.logs()
+            log_text = sb._logs_raw()
             reply = _parse_reply_sentinel(log_text, msg_id, nonce=self.nonce)
             if reply is not None:
                 return reply
             # As in `send`: a terminal container is not a timeout, and refresh() is
             # the only live read of its status.
             if sb.refresh() in TERMINAL_STATUSES:
-                reply = _parse_reply_sentinel(sb.logs(), msg_id, nonce=self.nonce)
+                reply = _parse_reply_sentinel(sb._logs_raw(), msg_id, nonce=self.nonce)
                 if reply is not None:
                     return reply
                 raise SandboxError(_ended_before_reply(sb.status, msg_id))

{snowflake_sandbox_python-0.2.2a2.dist-info → snowflake_sandbox_python-0.2.2a4.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: snowflake-sandbox-python
-Version: 0.2.2a2
+Version: 0.2.2a4
 Summary: Snowflake sandboxes — Python SDK and CLI.
 Author: Snowflake, Inc.
 License: 

{snowflake_sandbox_python-0.2.2a2.dist-info → snowflake_sandbox_python-0.2.2a4.dist-info}/RECORD

@@ -1,9 +1,9 @@
 snowflake/cli_sandbox/__init__.py,sha256=9a_pevabd3fTnoLRIrjdu9Ff3M_E5N_H4qW6i_oq_70,591
 snowflake/cli_sandbox/_adapter.py,sha256=nQHcfTVI5hxjuOhM2CtMASmndou0a2SVa5ti3-OuY7Y,8480
 snowflake/cli_sandbox/_common.py,sha256=2SINRgB820KpQ4aIBUeVZy-9npqYcfyBPb83WTqK850,3159
-snowflake/cli_sandbox/_egress_flags.py,sha256=GupRm-BABGz9RId_SJoPFKCYRcv-3AWD9gvC6puynOg,5321
+snowflake/cli_sandbox/_egress_flags.py,sha256=4iOMPxwYcxnhIrDUl2yRybklqSOiuWnHfLUn5PKuFFE,5737
 snowflake/cli_sandbox/_get_command.py,sha256=ICMP_hfufKUTRiG2UKJU9Okk8nOyjGabbPUahl6o2cE,3397
-snowflake/cli_sandbox/_run_command.py,sha256=hevLhwVSy4lnmB1htZ-YlSFu09jjGvQ6TmRkYfd4K-M,44469
+snowflake/cli_sandbox/_run_command.py,sha256=BZpGFUKBAdPQOAyPX2bd9tc1php0rzD4XJ4yIxR-JU4,45000
 snowflake/cli_sandbox/_shell_command.py,sha256=VuLxAzcD3GuUIA6CRy95xfJe-hIJICqkPSK2wenoN5Y,26094
 snowflake/cli_sandbox/_upload_plan.py,sha256=JFZuRLQ0vgX82ugXr9UhAT1T-eIoYgFwGPOCyECVyts,7316
 snowflake/cli_sandbox/commands.py,sha256=IjJ0DRiwI4ljNtKlhavxlZoY66EP0Dd8vRJCEulwaeU,21720
@@ -17,7 +17,7 @@ snowflake/sandbox/_assemble.py,sha256=x52FpfRKJ_8j_hhS8qPDb2pZcmxbg1sQrxs31Upjmw
 snowflake/sandbox/_bundle.py,sha256=UclyMJ_NNOnR0cGM5G3ayTaJ3VDMy6aFh89Y_-fR6Kg,10019
 snowflake/sandbox/_connection_resolve.py,sha256=yIed7EtamXw13EpVvc6yvyo3km_dRigH2vARkreCW0M,16216
 snowflake/sandbox/_deploy_spec.py,sha256=YoKLL_9gf9NM-X0OEfW4VRU8oG2jy34Pd29-JGJnoFI,2225
-snowflake/sandbox/_diagnostics.py,sha256=58Gt5jv6I9PRRrDWHQrsWQupPUgaS0d-2A8a7EGwXQ8,20816
+snowflake/sandbox/_diagnostics.py,sha256=weA4vxiITQTHmMDZSk1zPHbdFH3otr-zs79wqOSgIvI,20949
 snowflake/sandbox/_env.py,sha256=7Afvpm8Ppg4LTQbMv99HJKn8QWOrMD5sMhBtSJwolME,6033
 snowflake/sandbox/_files_mixin.py,sha256=WZUlw40bNLtTLIsRi2iHJylTghegxz9NSDWFur3hATs,12986
 snowflake/sandbox/_fs_ops.py,sha256=_yOGwYNPkM9uq5-jDz8zuvwIlYkTPEgiDPhrfpDvSFk,11498
@@ -37,45 +37,45 @@ snowflake/sandbox/_sync_watch.py,sha256=_-62oyqH6o57O3FaYgfiRy1iyezhh_khYaHwJslS
 snowflake/sandbox/_transport.py,sha256=pqly1AjpTJTSbCQZfV2Oqi2K7OfYG1dGhQfSfXplkB0,63466
 snowflake/sandbox/_transport_errors.py,sha256=8-87F_4XT84kzHlPlrE83jgZVyRaRXgw12fGrQO1mzU,11776
 snowflake/sandbox/_upload_plan.py,sha256=4MTaLdLr0_QUuEObxJ4XmuH-lXoL7ixO0Y1wU5XkfPU,19758
-snowflake/sandbox/_version.py,sha256=WxQNdz-rkwfRcANlWa9MGMsiZF22teg0k23Q5pGVpZs,1519
+snowflake/sandbox/_version.py,sha256=XHrdqmMCueQVU5dzw6xaZyIVnK_hpxfD7QMEwhpUC0Q,1519
 snowflake/sandbox/_watch.py,sha256=mWYhEP7z4ETE_eXU149EBtHB1UVaRmU3RTja3S8cgCM,6919
-snowflake/sandbox/_wire.py,sha256=aOUadr-6r11uMbmkjMISOZpmJ5XTei7lFeMEXDRy64I,19594
+snowflake/sandbox/_wire.py,sha256=eBJp3F1hHj7sojphAVR0H4HfJIYZ6aAZNjenLbdl2Bc,22467
 snowflake/sandbox/app.py,sha256=czuPnGme5P2BMMoEpgNto96iC0KSSOF5aSsNkpTh3r4,9404
-snowflake/sandbox/client.py,sha256=EXk7pqrGQHITbqjN_KWKnUmHEDgn2uaCRO6HsqxAlWg,121063
+snowflake/sandbox/client.py,sha256=E5D6ybrPwJQhoQIx-dhg6zqZXE8PC4rY7tv1tnUz4k8,124511
 snowflake/sandbox/config.py,sha256=1iSC5mAwgo_dkBu7hhzM1-X9N2pXZFv46QjgOV8v37M,55491
-snowflake/sandbox/connect.py,sha256=gozwmkbLjdVda8CrmVmk8jXHVYb26U3N4O04mkVXbLc,13830
+snowflake/sandbox/connect.py,sha256=vE9tI3-MSS_1gJ1-mA37ntGsOvIqECvcgDrnkdZlMf0,13827
 snowflake/sandbox/deploy.py,sha256=4tBUFgC0BccMniT8XLOtFoPgGHrhQ6pPHYtXtNgtPe4,21574
-snowflake/sandbox/egress.py,sha256=JQACDQAC1i5UkzwZdoECcYT2eenW6Ew6a6BcqFKbSJo,21527
+snowflake/sandbox/egress.py,sha256=h-KlZAop8rtmO9AlGfSl6aDVw4ACX74za-dAGwsiuZc,26603
 snowflake/sandbox/exceptions.py,sha256=XDYENzKqouJHRawMNG9_2ueC9wK9y4Yu72ClQp8RdkU,12319
 snowflake/sandbox/exec_stream.py,sha256=KaU0X5UuhwBRj2ZYOVpSDojbjicOGS_VlOuRnEEf4fo,10902
 snowflake/sandbox/failure.py,sha256=V6izCcpwptn46OQ2DogWsiFr8RLF5pfzsapL8UkKAeY,2632
 snowflake/sandbox/files.py,sha256=yX1pdu6iDvVkRUJwWjf_F1jJaKZmoXCsLb4LfxZQR9A,22283
 snowflake/sandbox/function.py,sha256=p11PKf96-Rav2ujj0FNX_sy6bTML-hKVxqmqGI3_qFY,23885
 snowflake/sandbox/image.py,sha256=5x1rc0Nf8rUOR5tKcdSUoPtSy31cr0zctpaeBvVMU9A,1476
-snowflake/sandbox/jobs.py,sha256=0l89gpjk4yzPtCV_mjcKR2kZJQ1CBvpJ2SDww6zlcdE,28777
+snowflake/sandbox/jobs.py,sha256=mIJCL9mUlePLPfTaa5f6L8_EsGb2PW_N7fOmQ3aKkAI,28901
 snowflake/sandbox/lifecycle.py,sha256=1swNVWPBDGNGLVYWNa28eWuvQBONsLq6Wqky3d4Hzno,3287
-snowflake/sandbox/log_stream.py,sha256=jswT4Hh9aVnJN4CCQXdi6KIxCj-CI9YYnaG1Rq5sN8c,10030
+snowflake/sandbox/log_stream.py,sha256=5R6HIpRjttBUbtyoQ54jFeHCW0H0HQcECjCKSy5LQtU,10592
 snowflake/sandbox/mcp.py,sha256=khrfbn3VzsU7d7kAhouyChj3ql1i7rBQMYGRXKUoTGI,20661
 snowflake/sandbox/mount.py,sha256=I5jGvh07hgl7xabSN3VkphsB8aJcJCzjiQ4AdjeeA6k,6521
 snowflake/sandbox/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 snowflake/sandbox/secret.py,sha256=LQjbhOLPkNDGewFgjuWr4Z9AE0gUtf6YdA_0VzD7ID4,9869
 snowflake/sandbox/session_app.py,sha256=awg3HyOPQMTMvoTVUk0Gp6ngsv7rIEJvPwpN_8H6VyI,9862
 snowflake/sandbox/shell.py,sha256=iaouTkm_gS7so8H5xjm15APBBwyI-JU6nxBX0O34nnU,24965
-snowflake/sandbox/sync_client.py,sha256=qYu_7ALXA68U-EBfh8_3KGwGKtUaJguQ7tckULUKSv8,114739
+snowflake/sandbox/sync_client.py,sha256=tInHCaYD0qWJWknLCs_TdZSXtlsgNzUQsTX7Bb4blyk,118131
 snowflake/sandbox/sync_exec_stream.py,sha256=V3G149X2nOGjwiKVRDTmQ5PR20saD-mYYsqCbaKVGJI,9199
 snowflake/sandbox/sync_files.py,sha256=zuAe81PLDl4mIOyxJfygJ9F9OFmw-r4Pdime9QqsPHc,12849
-snowflake/sandbox/sync_log_stream.py,sha256=9gsHIBntHzPFf_aN9WN8w62vm_ocjpI4EYdgKW9nJZw,5719
+snowflake/sandbox/sync_log_stream.py,sha256=PxsTDA0yevB19ckyUclnG7XNjso8IwqNO-xukaBAMas,6281
 snowflake/sandbox/sync_shell.py,sha256=tQVhahzraXMnckKT_j42-5CKy2rKDKrwCma3YEiUfkM,18287
 snowflake/sandbox/types.py,sha256=foDUzp8K21HaCdjPOyTsnDYbBEgwTCWn5Kmtnwu2oqg,7775
-snowflake/sandbox/warm_session.py,sha256=kgmskWutApKbuWNq72_fslufkCUYPMN9oWg1qY7QBCM,60161
+snowflake/sandbox/warm_session.py,sha256=EZRBafnBC0dO9emJHF6HmtjE4CDW4mCua4MaXvfcyJs,60432
 snowflake/sandbox/_runtime/__init__.py,sha256=hvkrEARQOaMGvmx-jrjawcdDYTz8_0_mQqpyCUZG1F0,2346
 snowflake/sandbox/_runtime/_fs_helper.py,sha256=JQ-ODrESW-5vVCPUfike5Ghuvz0HgpSCgdcSyG2H0Yc,3655
 snowflake/sandbox/_runtime/_job_runner.py,sha256=ZdWaUGnD01bVFS87nOaciHhSSyj9nV7hPpT1Mfbmx2M,4335
 snowflake/sandbox/_runtime/_protocol.py,sha256=vpmweaMO3cFe3oS8r8sXzZ7qB3UO3FUi3x9sn0CoCl8,3786
 snowflake/sandbox/_runtime/_shims.py,sha256=fhirq9SQwRBeujYLobMaseUrElSYhGjEncDuX-X8pxE,14357
-snowflake_sandbox_python-0.2.2a2.dist-info/licenses/LICENSE,sha256=z8d0m5b2O9McPEK1xHG_dWgUBT6EfBDz6wA0F7xSPTA,11358
-snowflake_sandbox_python-0.2.2a2.dist-info/METADATA,sha256=hY84JbddevWvT9VQ3_wKIg_tSdlIz4PcNjip5pGd5_s,19495
-snowflake_sandbox_python-0.2.2a2.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
-snowflake_sandbox_python-0.2.2a2.dist-info/entry_points.txt,sha256=0U-_vAHe7ZSTIi191p653ObERfBI6Ik9QTvSc1cJkDc,80
-snowflake_sandbox_python-0.2.2a2.dist-info/top_level.txt,sha256=TY0gFSHKDdZy3THb0FGomyikWQasEGldIR1O0HGOHVw,10
-snowflake_sandbox_python-0.2.2a2.dist-info/RECORD,,
+snowflake_sandbox_python-0.2.2a4.dist-info/licenses/LICENSE,sha256=z8d0m5b2O9McPEK1xHG_dWgUBT6EfBDz6wA0F7xSPTA,11358
+snowflake_sandbox_python-0.2.2a4.dist-info/METADATA,sha256=6-ATo4-1tAKpIRZYzeCF_pBH-GWK1Ab2ABue7UtiTCA,19495
+snowflake_sandbox_python-0.2.2a4.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
+snowflake_sandbox_python-0.2.2a4.dist-info/entry_points.txt,sha256=0U-_vAHe7ZSTIi191p653ObERfBI6Ik9QTvSc1cJkDc,80
+snowflake_sandbox_python-0.2.2a4.dist-info/top_level.txt,sha256=TY0gFSHKDdZy3THb0FGomyikWQasEGldIR1O0HGOHVw,10
+snowflake_sandbox_python-0.2.2a4.dist-info/RECORD,,