snowflake-sandbox-python 0.2.2a3__py3-none-any.whl → 0.2.2a4__py3-none-any.whl

snowflake/cli_sandbox/_egress_flags.py

@@ -106,7 +106,12 @@ def build_egress(
 
     egress = Egress(
         external_access_integrations=integrations,
-        **({"allow_default_egress": False} if no_default_egress else {}),
+        # Uses the current parameter name. The CLI FLAG stays `--no-default-egress`: it is
+        # released, renaming it would break users' scripts, and that is a separate decision
+        # from the library parameter's name. So the flag spelling and the parameter spelling
+        # differ here deliberately — the alternative is the CLI depending on a deprecated
+        # parameter, which is worse.
+        **({"allow_public_package_registries": False} if no_default_egress else {}),
     )
     # Validate now, not at create time. `compile_egress` is pure and is what the client
     # runs anyway -- but it runs *after* connecting, so a mistyped host pair otherwise

snowflake/cli_sandbox/_run_command.py

@@ -312,7 +312,13 @@ def _print_inferred_plan(plan: _RunPlan) -> None:
     typer.echo(f"command:    {plan.command or '(image default)'}")
     if plan.egress is not None:
         eais = getattr(plan.egress, "external_access_integrations", ())
-        closed = getattr(plan.egress, "allow_default_egress", None) is False
+        # Read the RESOLVER, not any one spelling. There are three accepted names for this
+        # control and reading a specific field goes silently blind when a caller (or this
+        # CLI) uses a different one — which is exactly what happened: switching the flag's
+        # construction to allow_public_package_registries made this summary stop reporting
+        # "default-egress=closed" while the sandbox was still correctly closed. A dry run
+        # that under-reports the egress posture is worse than no dry run.
+        closed = getattr(plan.egress, "default_egress_allowed", None) is False
         bits = [f"eai={','.join(eais)}" if eais else "", "default-egress=closed" if closed else ""]
         if plan.secrets:
             bits.append(f"secrets={len(plan.secrets)}")

snowflake/sandbox/_diagnostics.py

@@ -127,19 +127,19 @@ def preflight_checks(spec: DeploySpec, bundle_root: Path | None = None) -> list[
         problems.append(Problem("error", str(exc)))
 
     # A secret's `host` and Snowflake reachability are different controls: the first is
-    # enforced at the credential swap, the second by allow_internet / the group
-    # booleans. A secret scoped to a host the sandbox cannot reach on Snowflake is
+    # enforced at the credential swap, the second by the egress level
+    # (allow_public_package_registries) / the group booleans. A secret scoped to a host the sandbox cannot reach on Snowflake is
     # silently useless, so say so. (eai_hosts is the SPCS perimeter and does not
     # affect Snowflake reachability, so it is deliberately not consulted here.)
     # Only warn when egress was *explicitly* closed AND no EAI was granted:
-    #   - allow_internet is tri-state: left unset the platform applies its permissive
+    #   - the egress level is tri-state: left unset the platform applies its permissive
     #     default, and actual reachability is then an Istio question we cannot answer
     #     from here — warning on it would be noise on the common path.
     #   - allow_github / allow_pypi are NOT credited here, and now never could be: both
     #     are inert, so neither makes a host reachable in any mode. The retired
     #     allowed_egress_hosts is likewise not consulted — hosts named there are ignored
     #     platform-side.
-    #   - Under allow_internet=False the only grant left is an EAI, whose network rules
+    #   - Under allow_public_package_registries=False the only grant left is an EAI, whose rules
     #     live in Snowflake and cannot be resolved from here — so an EAI being present is
     #     taken as "the caller has said how" (loop-invariant, hence hoisted out below).
     eg = spec.egress
@@ -153,13 +153,15 @@ def preflight_checks(spec: DeploySpec, bundle_root: Path | None = None) -> list[
                 hint = (
                     f"grant {h!r} with an External Access Integration and pass "
                     f'external_access_integrations=("MY_EAI",) — under '
-                    f"allow_internet=False that is the only grant the platform applies"
+                    f"allow_public_package_registries=False that is the only grant the "
+                    f"platform applies"
                 )
                 problems.append(
                     Problem(
                         "warn",
                         f"secret {s.fqn!r} is scoped to host {h!r}, which the sandbox cannot "
-                        f"reach with allow_internet=False — the credential could never be used",
+                        f"reach with allow_public_package_registries=False — the credential "
+                        f"could never be used",
                         hint,
                     )
                 )

snowflake/sandbox/_version.py

@@ -29,7 +29,7 @@ __all__ = ["__version__"]
 _DIST_NAME = "snowflake-sandbox-python"
 
 # Keep in sync with [project].version in pyproject.toml.
-_FALLBACK_VERSION = "0.2.2a3"
+_FALLBACK_VERSION = "0.2.2a4"
 
 try:
     __version__: str = _pkg_version(_DIST_NAME)

snowflake/sandbox/client.py

@@ -132,7 +132,7 @@ async def _coerce_image(image: str | Image, transport: Transport | None) -> str:
 
 
 class AsyncSandbox(_FilesMixin, _SandboxState):
-    """A Snowflake sandbox container (async API).
+    """A Cortex Sandbox (async API).
 
     ``await create()`` is the factory, and the only creation path -- ``AsyncSandbox(...)``
     raises. A constructor cannot be awaited, which is the deeper reason it was never the
@@ -769,12 +769,26 @@ class AsyncSandbox(_FilesMixin, _SandboxState):
             return
         await self._wait_until_ready(timeout=timeout)
 
-    async def logs(self, *, tail: int = 0, since_ts_ms: int = 0) -> str:
+    async def logs(
+        self, *, tail: int = 0, since_ts_ms: int = 0, source: str | None = None, pid: int = 0
+    ) -> str:
         """Return the container's captured stdout and stderr as a string.
 
         `tail` limits to the last N lines. Only meaningful for command containers
         (created with `command=`).
 
+        `source` selects which stream to read, defaulting to the server's `all` -- the
+        entrypoint plus the `command=` process:
+
+        - ``"exec"`` -- what the commands you ran with `exec()` printed, which no other
+          source includes. `exec()` also returns that output directly; this is how you
+          read it again afterwards.
+        - ``"base"`` / ``"managed"`` -- one of the two long-lived streams on its own.
+
+        `pid` narrows an exec read to one producer. Without it every exec is merged and
+        the returned text carries no per-line attribution; `pid=` is how you read one
+        command's output on its own.
+
         SDK-internal protocol markers are suppressed: the in-sandbox runner reports a
         run's outcome as `__SANDBOX_RESULT__<b64>` on stdout and the session daemon
         reports replies as `__SANDBOX_REPLY__<...>`, so both land in the log stream
@@ -785,10 +799,13 @@ class AsyncSandbox(_FilesMixin, _SandboxState):
         Example:
             output = await sb.logs(tail=100)
             print(output)
+
+            # What the commands you ran with `exec()` printed.
+            print(await sb.logs(source="exec"))
         """
         fetch = _logs_overfetch(tail)
         while True:
-            raw = await self._logs_raw(tail=fetch, since_ts_ms=since_ts_ms)
+            raw = await self._logs_raw(tail=fetch, since_ts_ms=since_ts_ms, source=source, pid=pid)
             raw_count = len(raw.split("\n")) if raw else 0
             visible = _visible_log_lines(raw)
             if tail <= 0 or len(visible) >= tail:
@@ -806,7 +823,9 @@ class AsyncSandbox(_FilesMixin, _SandboxState):
             visible = visible[-tail:]
         return "\n".join(visible)
 
-    async def _logs_raw(self, *, tail: int = 0, since_ts_ms: int = 0) -> str:
+    async def _logs_raw(
+        self, *, tail: int = 0, since_ts_ms: int = 0, source: str | None = None, pid: int = 0
+    ) -> str:
         """The log snapshot EXACTLY as the server returns it, markers included.
 
         Internal consumers that read the runner's or daemon's stdout protocol
@@ -825,6 +844,14 @@ class AsyncSandbox(_FilesMixin, _SandboxState):
             q.append(f"tail={tail}")
         if since_ts_ms:
             q.append(f"since={since_ts_ms}")
+        # Forwarded verbatim rather than validated here: the server owns the vocabulary
+        # and names the valid values in its rejection, so a client-side allowlist would go
+        # stale as soon as a source is added and would turn a 400 that explains itself
+        # into one that does not.
+        if source:
+            q.append(f"source={source}")
+        if pid:
+            q.append(f"pid={pid}")
         path = f"containers/{self._id}/logs" + ("?" + "&".join(q) if q else "")
         try:
             resp = await self._transport.request(

snowflake/sandbox/connect.py

@@ -251,7 +251,7 @@ def _make_connection(**kwargs: Any) -> Any:
 
 
 def get_snowflake_connection(**kwargs: Any) -> Any:
-    """Return a Snowflake connection for code running inside a Snowflake sandbox.
+    """Return a Snowflake connection for code running inside a Cortex Sandbox.
 
     Resolves the credential the way the platform provides it, in order: the
     ``SNOWFLAKE_PAT``/``SNOWFLAKE_TOKEN`` env value; a token file named by

snowflake/sandbox/egress.py

@@ -48,7 +48,7 @@ def _retired_host_list_message(spelling: str) -> str:
         f"locally instead: the sandbox would start healthy and silently fail to reach "
         f"them.\n\n"
         f"Grant the hosts with an External Access Integration and name it instead:\n"
-        f'    Egress(allow_default_egress=False, external_access_integrations=("MY_EAI",))\n\n'
+        f'    Egress(allow_public_package_registries=False, external_access_integrations=("MY_EAI",))\n\n'
         f"Creating one (the network rule cannot live in a personal USER$ database):\n"
         f"    CREATE NETWORK RULE db.schema.my_rule MODE = EGRESS TYPE = HOST_PORT\n"
         f"        VALUE_LIST = ('example.com:443');\n"
@@ -71,11 +71,30 @@ def _nonempty_host_value(raw: object) -> bool:
     return len(raw) > 0
 
 
-# The REST spelling of the default-egress tri-state. Named once: the SDK parameter was
-# renamed to allow_default_egress, the wire key was not, and two places translate between
-# them (Egress.to_wire and compile_egress's raw-dict path).
+# The REST spelling this client SENDS for the egress tri-state. Named once because the
+# client parameter and the wire key have diverged and two places translate between them
+# (Egress.to_wire and compile_egress's raw-dict path).
+#
+# DELIBERATELY still "allow_internet", even though sandbox-api now has
+# allow_public_package_registries (sandbox-api#349) and every tier accepts it (measured
+# 2026-09-24). Do NOT "fix" this to the new key as a tidy-up — that couples a client-side
+# naming improvement to a deployment risk:
+#
+#   - sandbox-api keeps honouring allow_internet deliberately, for pinned SDKs exactly like
+#     this one (containers/egress.go: "the superseded one and still means exactly the same
+#     thing"; containers/models.go names "every pinned sandbox-sdk" as the reason).
+#   - A prod rollback to a pre-#349 build would 400 every create carrying the NEW key, while
+#     the old key keeps working against every build, reverted or not.
+#
+# Switching it is its own decision, gated on the prod rollback window closing — not on the
+# field being accepted. Until then this is the one spelling that is safe everywhere.
 _DEFAULT_EGRESS_WIRE_KEY = "allow_internet"
 
+# The current, honest client parameter name; it matches sandbox-api's field and the Snowsight
+# dialog copy ("Snowflake and public package registries"). The two older spellings below stay
+# accepted because they shipped.
+_EGRESS_LEVEL_PARAM = "allow_public_package_registries"
+
 
 @dataclass(frozen=True)
 class Egress:
@@ -87,8 +106,8 @@ class Egress:
 
     | level | how | reaches |
     |---|---|---|
-    | baseline | the default, or `allow_default_egress=True` | Snowflake, the cloud-storage stages, and ~43 package-manager hosts |
-    | closed | `allow_default_egress=False` / `Egress.only()` | Snowflake and its stages only |
+    | baseline | the default, or `allow_public_package_registries=True` | Snowflake, the cloud-storage stages, and ~43 package-manager hosts |
+    | closed | `allow_public_package_registries=False` / `Egress.only()` | Snowflake and its stages only |
     | granted | `external_access_integrations=(...)` | the above, plus whatever the EAI's network rules resolve to |
 
     **The baseline is not the internet.** It is a curated host set the platform
@@ -96,17 +115,30 @@ class Egress:
     list requires an External Access Integration whichever level you pick. A
     caller-supplied host list used to be the third option and is now retired.
 
-    `allow_internet` is the former name of `allow_default_egress` and still works, with a
-    DeprecationWarning. It was misleading in both directions: it never granted the whole
-    internet, and False does not stop egress because an EAI still grants.
+    **The parameter is `allow_public_package_registries`.** Two earlier spellings still work
+    and are deprecated — `allow_default_egress` and, before it, `allow_internet`. Setting more
+    than one to *different* values raises, since they are one control.
+
+    Neither older name survived contact with what the field does. `allow_internet` was wrong
+    in both directions: it never granted the internet (the baseline is a curated ~43-host set,
+    GET/HEAD only), and `False` does not stop egress because an EAI still grants.
+    `allow_default_egress` then named the value's *provenance* rather than what it grants, and
+    self-contradicts the moment the platform default changes — at which point
+    `default_egress=False` would *be* the default. The current name says what is granted.
+
+    Neither older name emits a DeprecationWarning yet. That is deliberate and not an
+    oversight: the warning would fire on construction, so adding it means migrating every
+    test and example that still uses an old name, for no behaviour change. It arrives with the
+    release that removes them.
 
     Example:
         egress = Egress()                                # baseline
         egress = Egress.only()                           # closed: nothing arbitrary
-        egress = Egress(allow_default_egress=False, external_access_integrations=("MY_EAI",))
+        egress = Egress(allow_public_package_registries=False,
+                        external_access_integrations=("MY_EAI",))
 
-    `allow_github` and `allow_pypi` are both **deprecated and inert**. `allow_internet` is
-    the only egress control. Public PyPI is already reachable via the package-managers
+    `allow_github` and `allow_pypi` are both **deprecated and inert**; the egress level is the
+    only control that does anything. Public PyPI is already reachable via the package-managers
     group, and the six GitHub/dbt hosts now need an External Access Integration like any
     other host outside that group. Both flags will be removed in a future release.
     """
@@ -118,8 +150,8 @@ class Egress:
     # baseline and disables the group flags below.
     allow_internet: bool | None = None
     # Deprecated and inert. It set EgressConfig.allow_egress_to_github_and_dbt, the six-host
-    # GitHub/dbt group, which the platform is removing — leaving allow_internet as the only
-    # egress control. Those hosts need an External Access Integration now. Setting it does
+    # GitHub/dbt group, which the platform is removing — leaving the egress level as the only
+    # control. Those hosts need an External Access Integration now. Setting it does
     # nothing and, unlike allow_pypi, does not even warn (see __new__); to_wire() no longer
     # sends it. Retained and still defaulting True, so existing callers keep constructing
     # without a TypeError and no value of it reads as meaningful; remove in a later major.
@@ -139,7 +171,25 @@ class Egress:
     # replaces. Appended last so positional Egress(None, True, False, (...)) callers are
     # unaffected. The WIRE key is still allow_internet — this is a client-side rename, so
     # no server change is needed and old and new SDKs interoperate.
+    #
+    # SUPERSEDED by allow_public_package_registries below. Kept working, not removed: it
+    # shipped in v0.2.1a1 / v0.2.2.dev1 / v0.2.2a2 / v0.2.2a3, so deleting it would break
+    # callers who adopted it.
     allow_default_egress: bool | None = None
+    # The current name, and the one to use. Matches sandbox-api's request field
+    # (allow_public_package_registries, sandbox-api#349) and the Snowsight dialog's wording,
+    # so the client, the wire contract and the UI finally agree on what this knob is called.
+    #
+    # Why the two names above are not it. "internet" was wrong in both directions: it never
+    # granted the internet (the baseline is ~43 curated hosts, GET/HEAD only) and False does
+    # not stop egress, because an EAI still grants. "default egress" then described the
+    # value's PROVENANCE rather than what it grants, and self-contradicts the moment the
+    # platform default changes — at which point "default_egress=False" would BE the default.
+    # This name says what is actually granted: access to public package registries.
+    #
+    # Appended last so positional Egress(None, True, False, (...), None) callers are
+    # unaffected. Tri-state exactly like the fields it supersedes.
+    allow_public_package_registries: bool | None = None
 
     def __post_init__(self) -> None:
         # A dataclass enforces no types, so Egress(allow_internet="false") kept the string and
@@ -148,6 +198,7 @@ class Egress:
         for name, nullable in (
             ("allow_internet", True),
             ("allow_default_egress", True),
+            ("allow_public_package_registries", True),
             ("allow_github", False),
             ("allow_pypi", False),
         ):
@@ -158,17 +209,21 @@ class Egress:
                 raise SandboxError(
                     f"Egress({name}=) must be True or False, got {type(value).__name__} {value!r}"
                 )
-        # Both spellings set and disagreeing is ambiguous, and picking one silently would
+        # Any two spellings set and disagreeing is ambiguous, and picking one silently would
         # apply an egress posture the caller did not ask for. Raise at the call instead.
-        if (
-            self.allow_internet is not None
-            and self.allow_default_egress is not None
-            and self.allow_internet != self.allow_default_egress
-        ):
+        # Checked pairwise across all THREE names, not just the newest pair: a caller
+        # mid-migration can easily have the oldest and newest both set.
+        spellings = [
+            ("allow_public_package_registries", self.allow_public_package_registries),
+            ("allow_default_egress", self.allow_default_egress),
+            ("allow_internet", self.allow_internet),
+        ]
+        given = [(n, v) for n, v in spellings if v is not None]
+        if len({v for _, v in given}) > 1:
+            shown = ", ".join(f"{n}={v!r}" for n, v in given)
             raise SandboxError(
-                "Egress(allow_internet=) and Egress(allow_default_egress=) disagree "
-                f"({self.allow_internet!r} vs {self.allow_default_egress!r}). They are the "
-                "same control — pass only allow_default_egress."
+                f"Egress spellings of the egress level disagree ({shown}). They are all the "
+                f"same control — pass only {_EGRESS_LEVEL_PARAM}."
             )
         # NOT warned on deliberately. The suite runs filterwarnings=error, so emitting a
         # DeprecationWarning here fails all 21 tests that construct Egress(allow_internet=)
@@ -194,7 +249,8 @@ class Egress:
     def only() -> Egress:
         """Close egress — ``Egress.only()``, with no arguments.
 
-        Sets ``allow_default_egress=False``, which withholds the platform baseline as well: no
+        Sets ``allow_public_package_registries=False``, which withholds the platform baseline as
+        well: no
         arbitrary internet host is reachable, not even the package-manager set the default
         mode grants. Snowflake and its stages stay reachable regardless — see the danger
         note below, which is why this is not described as total confinement.
@@ -203,7 +259,7 @@ class Egress:
         caller-supplied host list; to confine and then grant a specific host, pair
         confinement with an External Access Integration:
 
-            Egress(allow_default_egress=False, external_access_integrations=("MY_EAI",))
+            Egress(allow_public_package_registries=False, external_access_integrations=("MY_EAI",))
 
         !!! danger "Not an exfiltration boundary for Snowflake destinations"
             ``only()`` does **not** confine the sandbox to *just* a chosen set of hosts.
@@ -220,9 +276,9 @@ class Egress:
             restriction. See *Reachability is not credential scope* above and the
             ``Secret`` docs.
         """
-        # New spelling deliberately: only() must not emit a DeprecationWarning at a
-        # caller who never touched the old name.
-        return Egress(allow_default_egress=False)
+        # Current spelling deliberately: only() must not attribute a deprecated name to a
+        # caller who never typed one.
+        return Egress(allow_public_package_registries=False)
 
     @property
     def default_egress_allowed(self) -> bool | None:
@@ -232,6 +288,8 @@ class Egress:
         look "unset" to logic that checks the old one, which is the bug a plain alias
         would introduce.
         """
+        if self.allow_public_package_registries is not None:
+            return self.allow_public_package_registries
         if self.allow_default_egress is not None:
             return self.allow_default_egress
         return self.allow_internet
@@ -246,7 +304,11 @@ class Egress:
         if effective is not None:
             # Sent even when False: the platform reads an absent key as its permissive
             # default, so omitting it would silently discard a request to close egress.
-            # The key stays allow_internet — the rename is client-side only.
+            #
+            # EXACTLY ONE spelling goes on the wire. sandbox-api refuses a request carrying
+            # two spellings that disagree (containers/egress.go), so a client that sent both
+            # could produce a refusal that reads as a server bug. See
+            # _DEFAULT_EGRESS_WIRE_KEY for why that one spelling is still allow_internet.
             body[_DEFAULT_EGRESS_WIRE_KEY] = effective
         # Neither group flag is sent: the platform is removing the GitHub/dbt flag and already
         # reserved the one allow_pypi fed, so either would describe a grant that never happens.
@@ -302,8 +364,10 @@ def compile_egress(
     the two now coincide: the only meaningful field is the default-egress tri-state, whose
     default is the platform's own, so a default `Egress` serialises to nothing. A dict is
     taken as authored, since that path is the raw-wire escape hatch — except that
-    ``allow_default_egress`` is translated to the wire key, because a raw-dict caller who
-    used the name the docs now teach would otherwise have it silently ignored.
+    ``allow_public_package_registries`` and the older ``allow_default_egress`` are both
+    translated to the single wire key this client sends, because a raw-dict caller who used
+    the name the docs teach would otherwise have it silently ignored — and because sandbox-api
+    refuses a request that carries two disagreeing spellings of the same control.
     """
     if isinstance(egress, Egress):
         body = egress.to_wire()
@@ -312,18 +376,28 @@ def compile_egress(
     else:
         body = dict(egress)
         # A raw dict is otherwise passed through verbatim, which would make
-        # {"allow_default_egress": False} a silent no-op: the server sees no
-        # allow_internet key and applies its PERMISSIVE default, so a caller asking to
-        # close egress would get the baseline instead. Translate to the wire key rather
-        # than refuse, matching what the typed path accepts.
-        if "allow_default_egress" in body:
-            renamed = body.pop("allow_default_egress")
+        # {"allow_public_package_registries": False} or {"allow_default_egress": False} a
+        # silent no-op ON A CLIENT PATH THAT SENDS THE OLD KEY: the server would see no
+        # allow_internet key and apply its PERMISSIVE default, so a caller asking to close
+        # egress would get the baseline instead. Translate to the one wire key this client
+        # sends, rather than refuse, matching what the typed path accepts.
+        #
+        # EXACTLY ONE spelling may survive. sandbox-api refuses a request carrying two
+        # spellings that disagree, so collapsing them here turns a confusing server refusal
+        # into a local error naming the caller's own keys. Note allow_public_package_registries
+        # is BOTH a client name and a real wire key the server accepts — it is still collapsed
+        # onto _DEFAULT_EGRESS_WIRE_KEY so that one client cannot emit two spellings at once.
+        _level_aliases = ("allow_public_package_registries", "allow_default_egress")
+        for _alias in _level_aliases:
+            if _alias not in body:
+                continue
+            renamed = body.pop(_alias)
             existing = body.get(_DEFAULT_EGRESS_WIRE_KEY)
             if existing is not None and renamed is not None and existing != renamed:
                 raise SandboxError(
-                    f"egress dict sets both {_DEFAULT_EGRESS_WIRE_KEY!r} and "
-                    f"'allow_default_egress' to different values ({existing!r} vs "
-                    f"{renamed!r}). They are the same control — pass one."
+                    f"egress dict sets both {_DEFAULT_EGRESS_WIRE_KEY!r} and {_alias!r} to "
+                    f"different values ({existing!r} vs {renamed!r}). They are the same "
+                    f"control — pass one, and {_EGRESS_LEVEL_PARAM!r} is the current name."
                 )
             if renamed is not None:
                 body[_DEFAULT_EGRESS_WIRE_KEY] = renamed

snowflake/sandbox/sync_client.py

@@ -149,7 +149,7 @@ def _raise_if_stream_terminated(abort: StreamAbort) -> None:
 
 
 class Sandbox(_FilesMixin, _SandboxState):
-    """A Snowflake sandbox container (sync API).
+    """A Cortex Sandbox (sync API).
 
     `create()` is the factory, and the only creation path -- ``Sandbox(...)`` raises.
     Reconnect to an existing sandbox with ``Sandbox.connect(name)`` / `get_sandbox` /
@@ -768,12 +768,26 @@ class Sandbox(_FilesMixin, _SandboxState):
             return
         self._wait_until_ready(timeout=timeout)
 
-    def logs(self, *, tail: int = 0, since_ts_ms: int = 0) -> str:
+    def logs(
+        self, *, tail: int = 0, since_ts_ms: int = 0, source: str | None = None, pid: int = 0
+    ) -> str:
         """Return the container's captured stdout and stderr as a string.
 
         `tail` limits to the last N lines. Only meaningful for command containers
         (created with `command=`).
 
+        `source` selects which stream to read, defaulting to the server's `all` -- the
+        entrypoint plus the `command=` process:
+
+        - ``"exec"`` -- what the commands you ran with `exec()` printed, which no other
+          source includes. `exec()` also returns that output directly; this is how you
+          read it again afterwards.
+        - ``"base"`` / ``"managed"`` -- one of the two long-lived streams on its own.
+
+        `pid` narrows an exec read to one producer. Without it every exec is merged and
+        the returned text carries no per-line attribution; `pid=` is how you read one
+        command's output on its own.
+
         SDK-internal protocol markers are suppressed: the in-sandbox runner reports a
         run's outcome as `__SANDBOX_RESULT__<b64>` on stdout and the session daemon
         reports replies as `__SANDBOX_REPLY__<...>`, so both land in the log stream
@@ -784,10 +798,13 @@ class Sandbox(_FilesMixin, _SandboxState):
         Example:
             output = sb.logs(tail=100)
             print(output)
+
+            # What the commands you ran with `exec()` printed.
+            print(sb.logs(source="exec"))
         """
         fetch = _logs_overfetch(tail)
         while True:
-            raw = self._logs_raw(tail=fetch, since_ts_ms=since_ts_ms)
+            raw = self._logs_raw(tail=fetch, since_ts_ms=since_ts_ms, source=source, pid=pid)
             raw_count = len(raw.split("\n")) if raw else 0
             visible = _visible_log_lines(raw)
             if tail <= 0 or len(visible) >= tail:
@@ -805,7 +822,9 @@ class Sandbox(_FilesMixin, _SandboxState):
             visible = visible[-tail:]
         return "\n".join(visible)
 
-    def _logs_raw(self, *, tail: int = 0, since_ts_ms: int = 0) -> str:
+    def _logs_raw(
+        self, *, tail: int = 0, since_ts_ms: int = 0, source: str | None = None, pid: int = 0
+    ) -> str:
         """The log snapshot EXACTLY as the server returns it, markers included.
 
         Internal consumers that read the runner's or daemon's stdout protocol
@@ -824,6 +843,14 @@ class Sandbox(_FilesMixin, _SandboxState):
             q.append(f"tail={tail}")
         if since_ts_ms:
             q.append(f"since={since_ts_ms}")
+        # Forwarded verbatim rather than validated here: the server owns the vocabulary
+        # and names the valid values in its rejection, so a client-side allowlist would go
+        # stale as soon as a source is added and would turn a 400 that explains itself
+        # into one that does not.
+        if source:
+            q.append(f"source={source}")
+        if pid:
+            q.append(f"pid={pid}")
         path = f"containers/{self._id}/logs" + ("?" + "&".join(q) if q else "")
         try:
             resp = self._transport.request("GET", path, retry_500_delays=DEFAULT_LOGS_500_DELAYS_S)

{snowflake_sandbox_python-0.2.2a3.dist-info → snowflake_sandbox_python-0.2.2a4.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: snowflake-sandbox-python
-Version: 0.2.2a3
+Version: 0.2.2a4
 Summary: Snowflake sandboxes — Python SDK and CLI.
 Author: Snowflake, Inc.
 License: 

{snowflake_sandbox_python-0.2.2a3.dist-info → snowflake_sandbox_python-0.2.2a4.dist-info}/RECORD

@@ -1,9 +1,9 @@
 snowflake/cli_sandbox/__init__.py,sha256=9a_pevabd3fTnoLRIrjdu9Ff3M_E5N_H4qW6i_oq_70,591
 snowflake/cli_sandbox/_adapter.py,sha256=nQHcfTVI5hxjuOhM2CtMASmndou0a2SVa5ti3-OuY7Y,8480
 snowflake/cli_sandbox/_common.py,sha256=2SINRgB820KpQ4aIBUeVZy-9npqYcfyBPb83WTqK850,3159
-snowflake/cli_sandbox/_egress_flags.py,sha256=GupRm-BABGz9RId_SJoPFKCYRcv-3AWD9gvC6puynOg,5321
+snowflake/cli_sandbox/_egress_flags.py,sha256=4iOMPxwYcxnhIrDUl2yRybklqSOiuWnHfLUn5PKuFFE,5737
 snowflake/cli_sandbox/_get_command.py,sha256=ICMP_hfufKUTRiG2UKJU9Okk8nOyjGabbPUahl6o2cE,3397
-snowflake/cli_sandbox/_run_command.py,sha256=hevLhwVSy4lnmB1htZ-YlSFu09jjGvQ6TmRkYfd4K-M,44469
+snowflake/cli_sandbox/_run_command.py,sha256=BZpGFUKBAdPQOAyPX2bd9tc1php0rzD4XJ4yIxR-JU4,45000
 snowflake/cli_sandbox/_shell_command.py,sha256=VuLxAzcD3GuUIA6CRy95xfJe-hIJICqkPSK2wenoN5Y,26094
 snowflake/cli_sandbox/_upload_plan.py,sha256=JFZuRLQ0vgX82ugXr9UhAT1T-eIoYgFwGPOCyECVyts,7316
 snowflake/cli_sandbox/commands.py,sha256=IjJ0DRiwI4ljNtKlhavxlZoY66EP0Dd8vRJCEulwaeU,21720
@@ -17,7 +17,7 @@ snowflake/sandbox/_assemble.py,sha256=x52FpfRKJ_8j_hhS8qPDb2pZcmxbg1sQrxs31Upjmw
 snowflake/sandbox/_bundle.py,sha256=UclyMJ_NNOnR0cGM5G3ayTaJ3VDMy6aFh89Y_-fR6Kg,10019
 snowflake/sandbox/_connection_resolve.py,sha256=yIed7EtamXw13EpVvc6yvyo3km_dRigH2vARkreCW0M,16216
 snowflake/sandbox/_deploy_spec.py,sha256=YoKLL_9gf9NM-X0OEfW4VRU8oG2jy34Pd29-JGJnoFI,2225
-snowflake/sandbox/_diagnostics.py,sha256=58Gt5jv6I9PRRrDWHQrsWQupPUgaS0d-2A8a7EGwXQ8,20816
+snowflake/sandbox/_diagnostics.py,sha256=weA4vxiITQTHmMDZSk1zPHbdFH3otr-zs79wqOSgIvI,20949
 snowflake/sandbox/_env.py,sha256=7Afvpm8Ppg4LTQbMv99HJKn8QWOrMD5sMhBtSJwolME,6033
 snowflake/sandbox/_files_mixin.py,sha256=WZUlw40bNLtTLIsRi2iHJylTghegxz9NSDWFur3hATs,12986
 snowflake/sandbox/_fs_ops.py,sha256=_yOGwYNPkM9uq5-jDz8zuvwIlYkTPEgiDPhrfpDvSFk,11498
@@ -37,15 +37,15 @@ snowflake/sandbox/_sync_watch.py,sha256=_-62oyqH6o57O3FaYgfiRy1iyezhh_khYaHwJslS
 snowflake/sandbox/_transport.py,sha256=pqly1AjpTJTSbCQZfV2Oqi2K7OfYG1dGhQfSfXplkB0,63466
 snowflake/sandbox/_transport_errors.py,sha256=8-87F_4XT84kzHlPlrE83jgZVyRaRXgw12fGrQO1mzU,11776
 snowflake/sandbox/_upload_plan.py,sha256=4MTaLdLr0_QUuEObxJ4XmuH-lXoL7ixO0Y1wU5XkfPU,19758
-snowflake/sandbox/_version.py,sha256=bmg8r4C73B-qVDqxmzi2KgvDQScWldJEsfnpZdofMtU,1519
+snowflake/sandbox/_version.py,sha256=XHrdqmMCueQVU5dzw6xaZyIVnK_hpxfD7QMEwhpUC0Q,1519
 snowflake/sandbox/_watch.py,sha256=mWYhEP7z4ETE_eXU149EBtHB1UVaRmU3RTja3S8cgCM,6919
 snowflake/sandbox/_wire.py,sha256=eBJp3F1hHj7sojphAVR0H4HfJIYZ6aAZNjenLbdl2Bc,22467
 snowflake/sandbox/app.py,sha256=czuPnGme5P2BMMoEpgNto96iC0KSSOF5aSsNkpTh3r4,9404
-snowflake/sandbox/client.py,sha256=NDYJnglbSZX92KSGqhksTwV_cnGNG4owJiZXHWV8_Ic,123221
+snowflake/sandbox/client.py,sha256=E5D6ybrPwJQhoQIx-dhg6zqZXE8PC4rY7tv1tnUz4k8,124511
 snowflake/sandbox/config.py,sha256=1iSC5mAwgo_dkBu7hhzM1-X9N2pXZFv46QjgOV8v37M,55491
-snowflake/sandbox/connect.py,sha256=gozwmkbLjdVda8CrmVmk8jXHVYb26U3N4O04mkVXbLc,13830
+snowflake/sandbox/connect.py,sha256=vE9tI3-MSS_1gJ1-mA37ntGsOvIqECvcgDrnkdZlMf0,13827
 snowflake/sandbox/deploy.py,sha256=4tBUFgC0BccMniT8XLOtFoPgGHrhQ6pPHYtXtNgtPe4,21574
-snowflake/sandbox/egress.py,sha256=JQACDQAC1i5UkzwZdoECcYT2eenW6Ew6a6BcqFKbSJo,21527
+snowflake/sandbox/egress.py,sha256=h-KlZAop8rtmO9AlGfSl6aDVw4ACX74za-dAGwsiuZc,26603
 snowflake/sandbox/exceptions.py,sha256=XDYENzKqouJHRawMNG9_2ueC9wK9y4Yu72ClQp8RdkU,12319
 snowflake/sandbox/exec_stream.py,sha256=KaU0X5UuhwBRj2ZYOVpSDojbjicOGS_VlOuRnEEf4fo,10902
 snowflake/sandbox/failure.py,sha256=V6izCcpwptn46OQ2DogWsiFr8RLF5pfzsapL8UkKAeY,2632
@@ -61,7 +61,7 @@ snowflake/sandbox/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 snowflake/sandbox/secret.py,sha256=LQjbhOLPkNDGewFgjuWr4Z9AE0gUtf6YdA_0VzD7ID4,9869
 snowflake/sandbox/session_app.py,sha256=awg3HyOPQMTMvoTVUk0Gp6ngsv7rIEJvPwpN_8H6VyI,9862
 snowflake/sandbox/shell.py,sha256=iaouTkm_gS7so8H5xjm15APBBwyI-JU6nxBX0O34nnU,24965
-snowflake/sandbox/sync_client.py,sha256=XqLiunOy5KrrK5t_kttRktsf44efnqMJEYGOCpo5N1s,116847
+snowflake/sandbox/sync_client.py,sha256=tInHCaYD0qWJWknLCs_TdZSXtlsgNzUQsTX7Bb4blyk,118131
 snowflake/sandbox/sync_exec_stream.py,sha256=V3G149X2nOGjwiKVRDTmQ5PR20saD-mYYsqCbaKVGJI,9199
 snowflake/sandbox/sync_files.py,sha256=zuAe81PLDl4mIOyxJfygJ9F9OFmw-r4Pdime9QqsPHc,12849
 snowflake/sandbox/sync_log_stream.py,sha256=PxsTDA0yevB19ckyUclnG7XNjso8IwqNO-xukaBAMas,6281
@@ -73,9 +73,9 @@ snowflake/sandbox/_runtime/_fs_helper.py,sha256=JQ-ODrESW-5vVCPUfike5Ghuvz0HgpSC
 snowflake/sandbox/_runtime/_job_runner.py,sha256=ZdWaUGnD01bVFS87nOaciHhSSyj9nV7hPpT1Mfbmx2M,4335
 snowflake/sandbox/_runtime/_protocol.py,sha256=vpmweaMO3cFe3oS8r8sXzZ7qB3UO3FUi3x9sn0CoCl8,3786
 snowflake/sandbox/_runtime/_shims.py,sha256=fhirq9SQwRBeujYLobMaseUrElSYhGjEncDuX-X8pxE,14357
-snowflake_sandbox_python-0.2.2a3.dist-info/licenses/LICENSE,sha256=z8d0m5b2O9McPEK1xHG_dWgUBT6EfBDz6wA0F7xSPTA,11358
-snowflake_sandbox_python-0.2.2a3.dist-info/METADATA,sha256=dm_5vsGiTfmOy1UtPoIRw7zr_AjESYfjvw9uR9eOSjM,19495
-snowflake_sandbox_python-0.2.2a3.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
-snowflake_sandbox_python-0.2.2a3.dist-info/entry_points.txt,sha256=0U-_vAHe7ZSTIi191p653ObERfBI6Ik9QTvSc1cJkDc,80
-snowflake_sandbox_python-0.2.2a3.dist-info/top_level.txt,sha256=TY0gFSHKDdZy3THb0FGomyikWQasEGldIR1O0HGOHVw,10
-snowflake_sandbox_python-0.2.2a3.dist-info/RECORD,,
+snowflake_sandbox_python-0.2.2a4.dist-info/licenses/LICENSE,sha256=z8d0m5b2O9McPEK1xHG_dWgUBT6EfBDz6wA0F7xSPTA,11358
+snowflake_sandbox_python-0.2.2a4.dist-info/METADATA,sha256=6-ATo4-1tAKpIRZYzeCF_pBH-GWK1Ab2ABue7UtiTCA,19495
+snowflake_sandbox_python-0.2.2a4.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
+snowflake_sandbox_python-0.2.2a4.dist-info/entry_points.txt,sha256=0U-_vAHe7ZSTIi191p653ObERfBI6Ik9QTvSc1cJkDc,80
+snowflake_sandbox_python-0.2.2a4.dist-info/top_level.txt,sha256=TY0gFSHKDdZy3THb0FGomyikWQasEGldIR1O0HGOHVw,10
+snowflake_sandbox_python-0.2.2a4.dist-info/RECORD,,