snowflake-sandbox-python 0.2.2a3__tar.gz → 0.2.2a5__tar.gz

{snowflake_sandbox_python-0.2.2a3/src/snowflake_sandbox_python.egg-info → snowflake_sandbox_python-0.2.2a5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: snowflake-sandbox-python
-Version: 0.2.2a3
+Version: 0.2.2a5
 Summary: Snowflake sandboxes — Python SDK and CLI.
 Author: Snowflake, Inc.
 License: 

{snowflake_sandbox_python-0.2.2a3 → snowflake_sandbox_python-0.2.2a5}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "snowflake-sandbox-python"
-version = "0.2.2a3"
+version = "0.2.2a5"
 description = "Snowflake sandboxes — Python SDK and CLI."
 readme = "README.md"
 requires-python = ">=3.11"
@@ -142,15 +142,45 @@ ignore_missing_imports = true
 asyncio_mode = "auto"
 asyncio_default_fixture_loop_scope = "function"
 testpaths = ["tests"]
-# Skip live tests by default — run with: pytest -m live --connection <name>
-addopts = "-m 'not live'"
+# Skip live and docs tests by default — run with:
+#   pytest -m live --connection <name>
+#   pytest -m docs            (add --docs-root if the checkout is not a sibling)
+addopts = "-m 'not live and not docs'"
 markers = [
     "live: tests that run against a real sandbox-api deployment",
-    # The promotion gate. A fast (~10 creates, 3-5 min) subset of `live` that a
-    # deployment must pass before it is promoted to the next tier. Chosen so every
-    # member fails LOUDLY on an unhealthy deployment: no egress tests (they assert
-    # "BLOCKED" and so pass for the wrong reason when networking is dead), nothing
-    # that skips on error, and nothing unbounded. Run with `-m smoke`.
+    # Needs a snowflake-prod-docs checkout, which is a SEPARATE repo. Excluded by
+    # default for the same reason `live` is: it reads state this repo does not own,
+    # so a plain `pytest` must never depend on it.
+    #
+    # Specifically, these tests pin the exact fenced-block sequence of every published
+    # tutorial. That is the right assertion for catching a broken tutorial, but it also
+    # means an ordinary tutorial edit in snowflake-prod-docs would fail THIS repo's
+    # suite for anyone who happens to keep a sibling docs checkout — a docs change
+    # breaking an SDK test run. CI never checks the docs repo out, so CI was never
+    # exposed; this keeps local runs equally unexposed.
+    #
+    # --docs-root still defaults to ../snowflake-prod-docs, so opting in needs no flag.
+    "docs: tests that read a snowflake-prod-docs checkout (see --docs-root)",
+    # The promotion gate. A fast subset of `live` that a deployment must pass before it
+    # is promoted to the next tier. Chosen so every member fails LOUDLY on an unhealthy
+    # deployment: nothing that skips on error, and nothing unbounded. Run with `-m smoke`.
+    #
+    # Measured on qa6-mdrach, 2026-10-05: **30 tests, 83s** (15 sync + 15 async;
+    # the 2026-09-24 figure of 15 tests / ~47s was the sync client only). Adding
+    # the two egress rows cost +16.6s over the 13-test predecessor's 29.9s.
+    #
+    # This used to say "no egress tests (they assert 'BLOCKED' and so pass for the wrong
+    # reason when networking is dead)". That reasoning was correct and is why egress was
+    # excluded — but it no longer describes the gate. The egress level's EXPLICIT rows are
+    # now gated, because the test that carries them defeats that specific objection: its
+    # restrictive leg asserts a liveness CONTROL (the sandbox can still reach its Snowflake
+    # account) so "refused" cannot be confused with "the proxy is refusing everything", and
+    # its permissive leg asserts a 200, which a dead network cannot produce.
+    #
+    # Still excluded, deliberately: the tier's DEFAULT egress level. Its correct value is
+    # tier-dependent while the opt-in flip rolls (permissive before, closed after), so
+    # gating it would freeze the train on precisely the change being rolled out. It stays in
+    # the broader `-m live` suite, where a human reads it against a known switch state.
     "smoke: promotion-gate subset of the live suite",
 ]
 filterwarnings = [

{snowflake_sandbox_python-0.2.2a3 → snowflake_sandbox_python-0.2.2a5}/src/snowflake/cli_sandbox/_egress_flags.py

@@ -106,7 +106,12 @@ def build_egress(
 
     egress = Egress(
         external_access_integrations=integrations,
-        **({"allow_default_egress": False} if no_default_egress else {}),
+        # Uses the current parameter name. The CLI FLAG stays `--no-default-egress`: it is
+        # released, renaming it would break users' scripts, and that is a separate decision
+        # from the library parameter's name. So the flag spelling and the parameter spelling
+        # differ here deliberately — the alternative is the CLI depending on a deprecated
+        # parameter, which is worse.
+        **({"allow_public_package_registries": False} if no_default_egress else {}),
     )
     # Validate now, not at create time. `compile_egress` is pure and is what the client
     # runs anyway -- but it runs *after* connecting, so a mistyped host pair otherwise

snowflake_sandbox_python-0.2.2a5/src/snowflake/cli_sandbox/_lifecycle_command.py

@@ -0,0 +1,108 @@
+"""``snow sandbox suspend`` and ``snow sandbox resume``.
+
+The CLI counterparts to ``Sandbox.suspend()`` / ``Sandbox.resume()``. Snowflake
+suspends an idle sandbox on its own timer; these let an operator bank a sandbox's
+state on demand, and wake one without running anything in it.
+"""
+
+from __future__ import annotations
+
+from typing import Any
+
+import typer
+
+# From _common, where these are DEFINED. Importing them via _get_command (which
+# re-exports them) is an implicit re-export and mypy rejects it.
+from snowflake.cli_sandbox._common import (
+    _CONN_HELP,
+    _USE_SNOW_CONN_HELP,
+    _apply_connection,
+    _resolve_sandbox_id,
+)
+
+
+def _suspend_command(
+    sandbox: str = typer.Argument(..., help="Sandbox name (or id) to suspend."),
+    use_snow_connection: bool = typer.Option(
+        True,
+        "--use-snow-connection/--no-snow-connection",
+        help=_USE_SNOW_CONN_HELP,
+    ),
+    connection: str | None = typer.Option(
+        None,
+        "--connection",
+        "-c",
+        help=_CONN_HELP,
+    ),
+    **options: Any,
+) -> None:
+    """Suspend a sandbox: snapshot its filesystem and tear the container down.
+
+    The sandbox keeps its files; the next thing that touches it brings it back on
+    that snapshot with a fresh process tree. Already-suspended is success.
+
+    Example:
+        snow sandbox suspend SANDBOX
+    """
+    from snowflake.cli_sandbox._adapter import sdk_connection
+    from snowflake.sandbox.exceptions import SandboxError
+    from snowflake.sandbox.sync_client import get_sandbox
+
+    _apply_connection(use_snow_connection, connection)
+    try:
+        # The SYNC client: AsyncSandbox.connect is itself a coroutine, so a bare
+        # asyncio.run(sb.suspend()) on its result would fail on a coroutine object.
+        # get_sandbox(), not Sandbox.connect(): _resolve_sandbox_id already turned a
+        # name into a cntr_ id, and connect() resolves its argument as a NAME -- so
+        # feeding it an id fails with "no sandbox named cntr_...".
+        #
+        # The SYNC client throughout: AsyncSandbox.connect is itself a coroutine, so a
+        # bare asyncio.run(sb.suspend()) on its result fails on a coroutine object.
+        get_sandbox(_resolve_sandbox_id(sandbox), connection=sdk_connection()).suspend()
+    except SandboxError as exc:
+        typer.echo(f"error: {exc}", err=True)
+        raise typer.Exit(1) from exc
+    typer.echo(f"suspended {sandbox}")
+
+
+def _resume_command(
+    sandbox: str = typer.Argument(..., help="Sandbox name (or id) to resume."),
+    use_snow_connection: bool = typer.Option(
+        True,
+        "--use-snow-connection/--no-snow-connection",
+        help=_USE_SNOW_CONN_HELP,
+    ),
+    connection: str | None = typer.Option(
+        None,
+        "--connection",
+        "-c",
+        help=_CONN_HELP,
+    ),
+    **options: Any,
+) -> None:
+    """Wake a suspended sandbox without running anything in it.
+
+    Rarely needed -- anything that touches a sandbox resumes it anyway -- so this
+    is for paying the cold start up front. Returns once the resume is under way,
+    not once the sandbox is serving.
+
+    Example:
+        snow sandbox resume SANDBOX
+    """
+    from snowflake.cli_sandbox._adapter import sdk_connection
+    from snowflake.sandbox.exceptions import SandboxError
+    from snowflake.sandbox.sync_client import get_sandbox
+
+    _apply_connection(use_snow_connection, connection)
+    try:
+        # get_sandbox(), not Sandbox.connect(): _resolve_sandbox_id already turned a
+        # name into a cntr_ id, and connect() resolves its argument as a NAME.
+        get_sandbox(_resolve_sandbox_id(sandbox), connection=sdk_connection()).resume()
+    except SandboxError as exc:
+        typer.echo(f"error: {exc}", err=True)
+        raise typer.Exit(1) from exc
+    typer.echo(f"resuming {sandbox}")
+
+
+_SUSPEND_HELP = "Suspend a sandbox, snapshotting its filesystem.\n\nExample:\n    snow sandbox suspend SANDBOX\n"
+_RESUME_HELP = "Resume a suspended sandbox.\n\nExample:\n    snow sandbox resume SANDBOX\n"

{snowflake_sandbox_python-0.2.2a3 → snowflake_sandbox_python-0.2.2a5}/src/snowflake/cli_sandbox/_run_command.py

@@ -312,7 +312,13 @@ def _print_inferred_plan(plan: _RunPlan) -> None:
     typer.echo(f"command:    {plan.command or '(image default)'}")
     if plan.egress is not None:
         eais = getattr(plan.egress, "external_access_integrations", ())
-        closed = getattr(plan.egress, "allow_default_egress", None) is False
+        # Read the RESOLVER, not any one spelling. There are three accepted names for this
+        # control and reading a specific field goes silently blind when a caller (or this
+        # CLI) uses a different one — which is exactly what happened: switching the flag's
+        # construction to allow_public_package_registries made this summary stop reporting
+        # "default-egress=closed" while the sandbox was still correctly closed. A dry run
+        # that under-reports the egress posture is worse than no dry run.
+        closed = getattr(plan.egress, "default_egress_allowed", None) is False
         bits = [f"eai={','.join(eais)}" if eais else "", "default-egress=closed" if closed else ""]
         if plan.secrets:
             bits.append(f"secrets={len(plan.secrets)}")

{snowflake_sandbox_python-0.2.2a3 → snowflake_sandbox_python-0.2.2a5}/src/snowflake/cli_sandbox/_upload_plan.py

@@ -2,7 +2,7 @@
 
 The *selection* engine (the walk, the skip reasons, `UploadPlan`) lives in
 `snowflake.sandbox._upload_plan`, because the library needs it too: `Sandbox.upload_dir`
-and the `from_local` bundle are the same decision about the same trees. What stays here
+and create-time bundle assembly are the same decision about the same trees. What stays here
 is the part that is genuinely about a command line — turning argv tokens into targets,
 and the errors that name CLI flags in their remediation.
 

{snowflake_sandbox_python-0.2.2a3 → snowflake_sandbox_python-0.2.2a5}/src/snowflake/cli_sandbox/commands.py

@@ -26,6 +26,12 @@ from snowflake.cli_sandbox._common import (
     _resolve_sandbox_id,
 )
 from snowflake.cli_sandbox._get_command import _CANCEL_HELP, _cancel_command, get
+from snowflake.cli_sandbox._lifecycle_command import (
+    _RESUME_HELP,
+    _SUSPEND_HELP,
+    _resume_command,
+    _suspend_command,
+)
 from snowflake.cli_sandbox._run_command import _RUN_HELP, _run_command
 from snowflake.cli_sandbox._shell_command import (  # noqa: F401  (re-export: import surface)
     _CREATE_RETRY_ATTEMPTS,
@@ -279,10 +285,15 @@ async def _stream_process_logs(sb: Any, tail: int) -> None:
 
 _LOGS_HELP = (
     "Print or follow a sandbox's output.\n\n"
-    "By default this is the captured stdout/stderr of the sandbox's managed process, "
-    "which only exists for command containers (created with `command=`). Snapshot by "
-    "default; --follow tails the SAME source live until the process finishes, printing "
-    "stdout to stdout and stderr to stderr so `2>` separates them.\n\n"
+    "By default this is the server's `all`: the container's own output plus the managed "
+    "process's, where a command container has one. Snapshot by "
+    "default; --follow instead tails the MANAGED process live until it finishes, printing "
+    "stdout to stdout and stderr to stderr so `2>` separates them. That is the only source "
+    "it can follow, which is why --source is snapshot-only.\n\n"
+    "--source reads a different captured stream: `exec` is what `exec()` calls printed, "
+    "kept per producer by guest-init; `base` is the container's own output; `all` is base "
+    "+ managed, and deliberately NOT exec, since an exec's output is already returned by "
+    "the call that produced it. --pid narrows `exec` to one producer.\n\n"
     "--file reads a file inside the sandbox instead. That is how you read a "
     "`run --detach` local-code run: its command is backgrounded rather than being the "
     "managed process, so its output is tee'd to a file and the managed-process log is "
@@ -291,6 +302,8 @@ _LOGS_HELP = (
     "    snow sandbox logs SANDBOX_ID\n"
     "    snow sandbox logs SANDBOX_ID --tail 50\n"
     "    snow sandbox logs SANDBOX_ID --follow\n"
+    "    snow sandbox logs SANDBOX_ID --source exec\n"
+    "    snow sandbox logs SANDBOX_ID --source exec --pid 295\n"
     "    snow sandbox logs SANDBOX_ID --file /tmp/sandbox-run.out --follow"
 )
 
@@ -318,6 +331,22 @@ def _logs_command(
         metavar="MS",
         help="Only lines at or after this server timestamp (Unix epoch ms). Ignored with --follow.",
     ),
+    source: str | None = typer.Option(
+        None,
+        "--source",
+        metavar="WHICH",
+        help="Which output to read: all (the default when omitted: base + managed, and it does "
+        "NOT include exec), managed (just the command= process), exec (what `exec()` calls "
+        "printed), or base (the container's own stdout/stderr). Snapshot only — --follow tails "
+        "the managed process and cannot follow another source.",
+    ),
+    pid: int = typer.Option(
+        0,
+        "--pid",
+        metavar="N",
+        help="With --source exec, read only this producer instead of every exec merged "
+        "by capture time. The pid is shown per line in the merged output.",
+    ),
     file: str | None = typer.Option(
         None,
         "--file",
@@ -347,6 +376,8 @@ def _logs_command(
     Example:
         snow sandbox logs SANDBOX_ID --tail 50
         snow sandbox logs SANDBOX_ID --follow
+        snow sandbox logs SANDBOX_ID --source exec
+        snow sandbox logs SANDBOX_ID --source exec --pid 295
         snow sandbox logs SANDBOX_ID --file /tmp/sandbox-run.out
     """
     import shlex
@@ -360,6 +391,19 @@ def _logs_command(
             "--since applies to the managed-process log, not to --file (a file has no "
             "server timestamps). Use --tail to limit the output instead."
         )
+    # Each of these would otherwise be accepted and then silently ignored, which is worse
+    # than a rejection: the caller reads output and believes it is what they asked for.
+    if source is not None and file is not None:
+        raise typer.BadParameter(
+            "--source selects a captured stream; --file reads a path. Pass one."
+        )
+    if source is not None and follow and source not in ("managed", "process"):
+        raise typer.BadParameter(
+            f"--follow tails the managed process and cannot follow --source {source}. "
+            "Drop --follow for a snapshot, or drop --source to follow the managed process."
+        )
+    if pid and source != "exec":
+        raise typer.BadParameter("--pid selects one exec producer, so it needs --source exec.")
 
     _apply_connection(use_snow_connection, connection)
 
@@ -373,7 +417,7 @@ def _logs_command(
         elif follow:
             await _stream_process_logs(sb, tail)
         else:
-            typer.echo(await sb.logs(tail=tail, since_ts_ms=since))
+            typer.echo(await sb.logs(tail=tail, since_ts_ms=since, source=source, pid=pid))
 
     async def _read_sandbox_file(sb: Any, path: str, *, tail: int, follow: bool) -> None:
         """Print, or tail, a file inside the sandbox.
@@ -554,3 +598,7 @@ app.command(name="delete", requires_connection=False, help=_DELETE_HELP)(_delete
 # so these are plain top-level verbs alongside `list`/`logs`/`delete`.
 app.command(name="get", requires_connection=False)(get)
 app.command(name="cancel", requires_connection=False, help=_CANCEL_HELP)(_cancel_command)
+# The two halves of the suspend/resume pair. Snowflake suspends an idle sandbox on its
+# own timer; these make both directions available on demand.
+app.command(name="suspend", requires_connection=False, help=_SUSPEND_HELP)(_suspend_command)
+app.command(name="resume", requires_connection=False, help=_RESUME_HELP)(_resume_command)

{snowflake_sandbox_python-0.2.2a3 → snowflake_sandbox_python-0.2.2a5}/src/snowflake/sandbox/__init__.py

@@ -28,6 +28,7 @@ from typing import TYPE_CHECKING, Any
 from snowflake.sandbox._version import __version__
 from snowflake.sandbox.exceptions import (
     SandboxAuthError,
+    SandboxBuildError,
     SandboxConflictError,
     SandboxContractWarning,
     SandboxCreateError,
@@ -124,6 +125,7 @@ __all__ = [
     "SandboxCreateError",
     "SandboxFailure",
     "SandboxValidationError",
+    "SandboxBuildError",
     "SandboxConflictError",
     "SandboxNotFoundError",
     "SandboxNotReadyError",

{snowflake_sandbox_python-0.2.2a3 → snowflake_sandbox_python-0.2.2a5}/src/snowflake/sandbox/_bundle.py

@@ -75,7 +75,7 @@ def _collect_tree(
     include: list[str] | None = None,
 ) -> tuple[list[tuple[str, bytes]], UploadPlan]:
     """Sorted ``(relpath, content)`` for every file under *src*, plus the plan that
-    says what was left out and why. Used by ``from_local``.
+    says what was left out and why. Used by create-time bundle assembly.
 
     Selection is delegated to `_upload_plan`, which is the one walk the CLI and
     `Sandbox.upload_dir` also use. This function used to own a second, weaker walk:
@@ -123,7 +123,7 @@ def _collect_tree(
         raise SandboxValidationError(
             f"no files to bundle from {src}: all {len(plan.skipped)} path(s) were "
             f"filtered out ({_reason_summary(plan)}). Pass include= to re-admit a "
-            f"filtered path, or point from_local at the directory holding your code."
+            f"filtered path, or point create(code=...) at the directory holding your code."
         )
     return files, plan
 

snowflake_sandbox_python-0.2.2a5/src/snowflake/sandbox/_code_delivery.py

@@ -0,0 +1,88 @@
+"""Create-time code delivery via ``upload_dir`` (no stage / no bootstrap).
+
+Deploy and ``Sandbox.create(code=)`` create an empty sandbox, upload the local
+tree into ``CODE_DIR``, then signal a ready marker so a wait-then-exec main
+command (detach / jobs / ``create(code=, command=…)``) can start the entry.
+"""
+
+from __future__ import annotations
+
+import shlex
+from collections.abc import Sequence
+from typing import TYPE_CHECKING
+
+if TYPE_CHECKING:
+    from snowflake.sandbox.client import AsyncSandbox
+    from snowflake.sandbox.sync_client import Sandbox
+
+__all__ = [
+    "CODE_DIR",
+    "READY_MARKER",
+    "cd_into_code_dir",
+    "entry_in_code_dir",
+    "signal_bundle_ready",
+    "signal_bundle_ready_sync",
+    "upload_bundle",
+    "upload_bundle_sync",
+    "wait_then_exec",
+]
+
+# Where ``upload_dir`` lands the project. Relative entries ``cd`` here before exec.
+CODE_DIR = "/tmp/_sandbox_code"
+READY_MARKER = f"{CODE_DIR}/.sandbox_bundle_ready"
+
+_CD_INTO_CODE_DIR = f"cd {shlex.quote(CODE_DIR)} && "
+# A copy of this name inside the uploaded tree must not count as "ready" —
+# the marker is written only after upload_dir returns.
+_MARKER_EXCLUDE = [".sandbox_bundle_ready", "**/.sandbox_bundle_ready"]
+
+
+def cd_into_code_dir() -> str:
+    """Shell fragment that cds into ``CODE_DIR`` and stops the command if that fails."""
+    return _CD_INTO_CODE_DIR
+
+
+def entry_in_code_dir(entry: Sequence[str]) -> list[str]:
+    """Wrap *entry* so it runs with cwd=``CODE_DIR`` after ``upload_dir``."""
+    inner = " ".join(shlex.quote(str(a)) for a in entry)
+    return ["/bin/bash", "-c", _CD_INTO_CODE_DIR + "exec " + inner]
+
+
+def wait_then_exec(entry: Sequence[str]) -> list[str]:
+    """Container main command: block until the ready marker exists, then exec *entry*.
+
+    Used when the entry must be the managed process (detach / jobs / ``create(code=)``)
+    but the bundle can only be uploaded after the sandbox is up.
+    """
+    inner = " ".join(shlex.quote(str(a)) for a in entry)
+    ready = shlex.quote(READY_MARKER)
+    body = f"while [ ! -f {ready} ]; do sleep 0.1; done; " + _CD_INTO_CODE_DIR + "exec " + inner
+    return ["/bin/bash", "-c", body]
+
+
+def _signal_script() -> str:
+    return f"mkdir -p {shlex.quote(CODE_DIR)} && touch {shlex.quote(READY_MARKER)}"
+
+
+async def upload_bundle(sb: AsyncSandbox, local_dir: str) -> None:
+    """Upload *local_dir* into ``CODE_DIR`` on a live sandbox.
+
+    The ready-marker name is excluded so a file in the tree cannot release a
+    ``wait_then_exec`` main process before the upload finishes.
+    """
+    await sb.upload_dir(local_dir, CODE_DIR, exclude=_MARKER_EXCLUDE)
+
+
+def upload_bundle_sync(sb: Sandbox, local_dir: str) -> None:
+    """Sync counterpart of `upload_bundle`."""
+    sb.upload_dir(local_dir, CODE_DIR, exclude=_MARKER_EXCLUDE)
+
+
+async def signal_bundle_ready(sb: AsyncSandbox) -> None:
+    """Write the ready marker so a `wait_then_exec` main process can proceed."""
+    await sb.exec(["/bin/bash", "-c", _signal_script()], timeout=60.0)
+
+
+def signal_bundle_ready_sync(sb: Sandbox) -> None:
+    """Sync counterpart of `signal_bundle_ready`."""
+    sb.exec(["/bin/bash", "-c", _signal_script()], timeout=60.0)

{snowflake_sandbox_python-0.2.2a3 → snowflake_sandbox_python-0.2.2a5}/src/snowflake/sandbox/_diagnostics.py

@@ -127,19 +127,19 @@ def preflight_checks(spec: DeploySpec, bundle_root: Path | None = None) -> list[
         problems.append(Problem("error", str(exc)))
 
     # A secret's `host` and Snowflake reachability are different controls: the first is
-    # enforced at the credential swap, the second by allow_internet / the group
-    # booleans. A secret scoped to a host the sandbox cannot reach on Snowflake is
+    # enforced at the credential swap, the second by the egress level
+    # (allow_public_package_registries) / the group booleans. A secret scoped to a host the sandbox cannot reach on Snowflake is
     # silently useless, so say so. (eai_hosts is the SPCS perimeter and does not
     # affect Snowflake reachability, so it is deliberately not consulted here.)
     # Only warn when egress was *explicitly* closed AND no EAI was granted:
-    #   - allow_internet is tri-state: left unset the platform applies its permissive
+    #   - the egress level is tri-state: left unset the platform applies its permissive
     #     default, and actual reachability is then an Istio question we cannot answer
     #     from here — warning on it would be noise on the common path.
     #   - allow_github / allow_pypi are NOT credited here, and now never could be: both
     #     are inert, so neither makes a host reachable in any mode. The retired
     #     allowed_egress_hosts is likewise not consulted — hosts named there are ignored
     #     platform-side.
-    #   - Under allow_internet=False the only grant left is an EAI, whose network rules
+    #   - Under allow_public_package_registries=False the only grant left is an EAI, whose rules
     #     live in Snowflake and cannot be resolved from here — so an EAI being present is
     #     taken as "the caller has said how" (loop-invariant, hence hoisted out below).
     eg = spec.egress
@@ -153,13 +153,15 @@ def preflight_checks(spec: DeploySpec, bundle_root: Path | None = None) -> list[
                 hint = (
                     f"grant {h!r} with an External Access Integration and pass "
                     f'external_access_integrations=("MY_EAI",) — under '
-                    f"allow_internet=False that is the only grant the platform applies"
+                    f"allow_public_package_registries=False that is the only grant the "
+                    f"platform applies"
                 )
                 problems.append(
                     Problem(
                         "warn",
                         f"secret {s.fqn!r} is scoped to host {h!r}, which the sandbox cannot "
-                        f"reach with allow_internet=False — the credential could never be used",
+                        f"reach with allow_public_package_registries=False — the credential "
+                        f"could never be used",
                         hint,
                     )
                 )

{snowflake_sandbox_python-0.2.2a3 → snowflake_sandbox_python-0.2.2a5}/src/snowflake/sandbox/_env.py

@@ -117,7 +117,7 @@ def validate_env_mapping(
     ``str(False)`` coercion is a footgun — ``env(DEBUG=False)`` would bake the
     string ``"False"``, which is truthy). *allow* names keys that are exempt
     from the reserved check because the SDK sets them itself (e.g.
-    ``SNOWFLAKE_CODE_URL``, the presigned-download URL ``from_local`` injects).
+    legacy ``SNOWFLAKE_CODE_URL`` stage bootstrap, now unused).
     Returns a plain ``dict[str, str]``. Raises `SandboxError`.
     """
     if not env: