withruntime 0.8.1__tar.gz → 0.8.3__tar.gz

{withruntime-0.8.1/withruntime.egg-info → withruntime-0.8.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: withruntime
-Version: 0.8.1
+Version: 0.8.3
 Summary: Runtime Cloud: one client (sync and async) for every Runtime product. Sandboxes first.
 License: Apache-2.0
 Project-URL: Homepage, https://withruntime.com
@@ -71,11 +71,18 @@ A sandbox has `exec`, `exec_stream`, `spawn`, `terminal`, `forward_port` (any
 TCP port in the sandbox on a local port), `files` (read, write,
 list, glob, stat, move, remove, upload and download directories), `pause`,
 `wake`, `extend`, `update`, `keep_alive`, `fork` and `snapshot`, and the
-`interpreter`, `network`, `previews` and `desktop` products. A paused sandbox
+`interpreter`, `network`, `previews`, `desktop`, `mounts` (your S3, R2 or Google
+Cloud Storage bucket as a folder), `metrics` and `mcp` (servers from the MCP
+catalog, run in the sandbox) products. A paused sandbox
 also wakes by itself on the next call, and `Sandbox.get_or_create(name)` returns
-the sandbox with that name or creates it. The client has `sandboxes`, `images`,
-`volumes`, `snapshots`, `limits`, `feedback` and `support`;
-`runtime.limits.get()` (0.3.1 and later) says whether the key is read-only and
+the sandbox with that name or creates it. A sandbox pauses itself after 60 seconds
+with nothing happening in it, keeping its memory and processes, so an
+idle sandbox costs no compute; `idle_pause_seconds` sets 10 to 86,400, or 0 for
+never. The client has `sandboxes`, `images`, `volumes`, `snapshots`,
+`secrets`, `limits`, `feedback` and `support`; `webhooks`, `events`, `otel` and
+`audit` to watch the account; `domains`, `ports`, `addresses`, `tunnel` and
+`network` to connect sandboxes to your own world (paid accounts); and `mcp`,
+`sso`, `billing`, `referrals` and `switching`. `runtime.limits.get()` (0.3.1 and later) says whether the key is read-only and
 what its agent may still spend today. Every write carries an
 idempotency key, so retries never do anything twice; errors are typed and carry
 `code`, `hint` and `request_id`.
@@ -159,8 +166,8 @@ How it maps:
   (every `/` becomes `-`; the tag is `latest` when none is given), so the
   code keeps Blaxel's image string. A missing one raises `NotSupportedError`
   with the build command, for example `npx withruntime image build
-  --dockerfile Dockerfile --name my-company-agent-image -t
-  my-company-agent-image:latest`. Volumes mount Runtime volumes of the same
+--dockerfile Dockerfile --name my-company-agent-image -t
+my-company-agent-image:latest`. Volumes mount Runtime volumes of the same
   name. On the free trial a sandbox has at most 4096 MB of memory (2 vCPUs).
 - **Standby.** A sandbox pauses after a minute with no call (Blaxel: about 15
   seconds). It keeps its memory and processes, and wakes on the next command,
@@ -200,17 +207,22 @@ Differences you can hit:
   (`/workspace`). File calls act as the sandbox user and fall back to `sudo`
   where only root may: they reach files a root process made, including private
   ones, and a file they write is the sandbox user's.
-- A sandbox is visible only to the key that created it: another key of the
-  same account gets 404 for it
+- A key sees the sandboxes it made, and another key's answer 404, unless an
+  owner or admin makes the key account-wide, as a Blaxel workspace key is
   ([teams](https://withruntime.com/docs/teams#keys-in-a-team)).
 - Public previews need a paid sandbox.
 - A process's `pid` is Runtime's process id, not an operating-system number.
+- `sandbox.sessions` makes a Runtime sandbox session, and
+  `SandboxInstance.from_session` drives the sandbox with its token: commands,
+  files and previews of that one sandbox. A session lasts a day at most, and
+  `Access-Control-Allow-Origin` in `response_headers` names the page that may
+  use it.
 
 These raise `NotSupportedError` before anything happens, naming what to use:
 regions outside the US, read-only and ephemeral volumes, drives, `extra_args`
 other than `iptables`, egress and subnet settings, preview headers, custom
 domains and preview expiry, restoring a snapshot in place (fork from it
-instead), sessions, codegen, `system`, schedules, and Blaxel's agents, models,
+instead), codegen, `system`, schedules, and Blaxel's agents, models,
 tools, jobs and applications. The sync module is generated from the async one
 by `scripts/generate_dropin_sync.py`.
 
@@ -223,6 +235,21 @@ gives LangChain, CrewAI, LlamaIndex, Pydantic AI, Google ADK and any framework
 that takes typed functions four sandbox tools. See
 https://withruntime.com/docs/frameworks.
 
+## Reliability and support
+
+- **Status:** https://withruntime.com/status checks the API from outside every
+  two minutes and starts a real sandbox every ten, with every day's record
+  kept; also as https://withruntime.com/status.md and
+  https://withruntime.com/status.json.
+- **Uptime Promise:** paid accounts are promised 99% API uptime
+  each calendar month, and a month below it pays 10% of that
+  month's charges back as credit, automatically
+  (https://withruntime.com/legal/sla).
+- **Security and compliance:** https://withruntime.com/docs/trust.
+- **What changed:** https://withruntime.com/changelog.
+- **Help:** `npx withruntime support "<question>"`, or
+  `npx withruntime feedback "<text>"` for anything that got in your way.
+
 Docs: https://withruntime.com/docs/python.
 
 The package was called `withruntime-cloud`, imported as `runtime_cloud`, until

{withruntime-0.8.1 → withruntime-0.8.3}/README.md

@@ -48,11 +48,18 @@ A sandbox has `exec`, `exec_stream`, `spawn`, `terminal`, `forward_port` (any
 TCP port in the sandbox on a local port), `files` (read, write,
 list, glob, stat, move, remove, upload and download directories), `pause`,
 `wake`, `extend`, `update`, `keep_alive`, `fork` and `snapshot`, and the
-`interpreter`, `network`, `previews` and `desktop` products. A paused sandbox
+`interpreter`, `network`, `previews`, `desktop`, `mounts` (your S3, R2 or Google
+Cloud Storage bucket as a folder), `metrics` and `mcp` (servers from the MCP
+catalog, run in the sandbox) products. A paused sandbox
 also wakes by itself on the next call, and `Sandbox.get_or_create(name)` returns
-the sandbox with that name or creates it. The client has `sandboxes`, `images`,
-`volumes`, `snapshots`, `limits`, `feedback` and `support`;
-`runtime.limits.get()` (0.3.1 and later) says whether the key is read-only and
+the sandbox with that name or creates it. A sandbox pauses itself after 60 seconds
+with nothing happening in it, keeping its memory and processes, so an
+idle sandbox costs no compute; `idle_pause_seconds` sets 10 to 86,400, or 0 for
+never. The client has `sandboxes`, `images`, `volumes`, `snapshots`,
+`secrets`, `limits`, `feedback` and `support`; `webhooks`, `events`, `otel` and
+`audit` to watch the account; `domains`, `ports`, `addresses`, `tunnel` and
+`network` to connect sandboxes to your own world (paid accounts); and `mcp`,
+`sso`, `billing`, `referrals` and `switching`. `runtime.limits.get()` (0.3.1 and later) says whether the key is read-only and
 what its agent may still spend today. Every write carries an
 idempotency key, so retries never do anything twice; errors are typed and carry
 `code`, `hint` and `request_id`.
@@ -136,8 +143,8 @@ How it maps:
   (every `/` becomes `-`; the tag is `latest` when none is given), so the
   code keeps Blaxel's image string. A missing one raises `NotSupportedError`
   with the build command, for example `npx withruntime image build
-  --dockerfile Dockerfile --name my-company-agent-image -t
-  my-company-agent-image:latest`. Volumes mount Runtime volumes of the same
+--dockerfile Dockerfile --name my-company-agent-image -t
+my-company-agent-image:latest`. Volumes mount Runtime volumes of the same
   name. On the free trial a sandbox has at most 4096 MB of memory (2 vCPUs).
 - **Standby.** A sandbox pauses after a minute with no call (Blaxel: about 15
   seconds). It keeps its memory and processes, and wakes on the next command,
@@ -177,17 +184,22 @@ Differences you can hit:
   (`/workspace`). File calls act as the sandbox user and fall back to `sudo`
   where only root may: they reach files a root process made, including private
   ones, and a file they write is the sandbox user's.
-- A sandbox is visible only to the key that created it: another key of the
-  same account gets 404 for it
+- A key sees the sandboxes it made, and another key's answer 404, unless an
+  owner or admin makes the key account-wide, as a Blaxel workspace key is
   ([teams](https://withruntime.com/docs/teams#keys-in-a-team)).
 - Public previews need a paid sandbox.
 - A process's `pid` is Runtime's process id, not an operating-system number.
+- `sandbox.sessions` makes a Runtime sandbox session, and
+  `SandboxInstance.from_session` drives the sandbox with its token: commands,
+  files and previews of that one sandbox. A session lasts a day at most, and
+  `Access-Control-Allow-Origin` in `response_headers` names the page that may
+  use it.
 
 These raise `NotSupportedError` before anything happens, naming what to use:
 regions outside the US, read-only and ephemeral volumes, drives, `extra_args`
 other than `iptables`, egress and subnet settings, preview headers, custom
 domains and preview expiry, restoring a snapshot in place (fork from it
-instead), sessions, codegen, `system`, schedules, and Blaxel's agents, models,
+instead), codegen, `system`, schedules, and Blaxel's agents, models,
 tools, jobs and applications. The sync module is generated from the async one
 by `scripts/generate_dropin_sync.py`.
 
@@ -200,6 +212,21 @@ gives LangChain, CrewAI, LlamaIndex, Pydantic AI, Google ADK and any framework
 that takes typed functions four sandbox tools. See
 https://withruntime.com/docs/frameworks.
 
+## Reliability and support
+
+- **Status:** https://withruntime.com/status checks the API from outside every
+  two minutes and starts a real sandbox every ten, with every day's record
+  kept; also as https://withruntime.com/status.md and
+  https://withruntime.com/status.json.
+- **Uptime Promise:** paid accounts are promised 99% API uptime
+  each calendar month, and a month below it pays 10% of that
+  month's charges back as credit, automatically
+  (https://withruntime.com/legal/sla).
+- **Security and compliance:** https://withruntime.com/docs/trust.
+- **What changed:** https://withruntime.com/changelog.
+- **Help:** `npx withruntime support "<question>"`, or
+  `npx withruntime feedback "<text>"` for anything that got in your way.
+
 Docs: https://withruntime.com/docs/python.
 
 The package was called `withruntime-cloud`, imported as `runtime_cloud`, until

{withruntime-0.8.1 → withruntime-0.8.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "withruntime"
-version = "0.8.1"
+version = "0.8.3"
 description = "Runtime Cloud: one client (sync and async) for every Runtime product. Sandboxes first."
 readme = "README.md"
 license = { text = "Apache-2.0" }

{withruntime-0.8.1 → withruntime-0.8.3}/tests/test_blaxel.py

@@ -1053,7 +1053,7 @@ class Interpreter(Base):
 class Unsupported(Base):
     def test_every_gap_is_importable_and_names_its_alternative(self):
         box = self.create()
-        calls = [lambda: box.sessions.create(), lambda: box.codegen.fastapply("a", "b"), lambda: box.system.upgrade(),
+        calls = [lambda: box.codegen.fastapply("a", "b"), lambda: box.system.upgrade(),
                  lambda: box.drives.mount("d", "/d"), lambda: box.schedules.list(),
                  lambda: SyncSandboxInstance.from_session({}), lambda: bl.BlAgent("x"), lambda: bl.bl_model("m"),
                  lambda: bl.settings.region, lambda: bl.SyncVolumeInstance.create({}),

{withruntime-0.8.1 → withruntime-0.8.3}/tests/test_daytona.py

@@ -238,6 +238,17 @@ class Process(Base):
         with self.assertRaises(NotSupportedError):
             sandbox.process.create_pty_session()
 
+    def test_refusals_point_at_what_runtime_has(self):
+        sandbox = self.daytona.create()
+        for call, text in ((sandbox.update_secrets, "withruntime secrets set"),
+                           (sandbox.get_metrics, "sandbox.withruntime.metrics("),
+                           (sandbox.create_ssh_access, "withruntime sandbox ssh"),
+                           (lambda: self.daytona.create(CreateSandboxFromSnapshotParams(secrets={"A": "s"})),
+                            "withruntime secrets set")):
+            with self.assertRaises(NotSupportedError) as caught:
+                call()
+            self.assertIn(text, caught.exception.alternative)
+
 
 class Files(Base):
     def test_files(self):

{withruntime-0.8.1 → withruntime-0.8.3}/tests/test_e2b_sandbox.py

@@ -380,6 +380,9 @@ class ForksPortsAndGaps(Base):
                      lambda: e2b.Secret.create("s"), lambda: e2b.wait_for_port(3000)):
             with self.assertRaises(NotSupportedException):
                 call()
+        with self.assertRaises(NotSupportedException) as caught:
+            e2b.Secret.create("s")
+        self.assertIn("withruntime secrets set", str(caught.exception))
 
 
 class Async(unittest.TestCase):

withruntime-0.8.3/tests/test_files_upload_parallel.py

@@ -0,0 +1,76 @@
+"""A large write keeps eight chunks in flight, in both client forms.
+
+Each chunk's reply waits on the API and the guest, so the link idles while
+every chunk in flight waits: four in flight took 100 MB 17-18 s from a
+12.6 MB/s home link, eight took 11 s (27 September 2026)."""
+import asyncio
+import threading
+import time
+import unittest
+from withruntime._async_client import AsyncFiles
+from withruntime._sync_client import Files
+
+MIB = 1048576
+
+
+class Counter:
+    def __init__(self):
+        self.now = self.most = self.chunks = 0
+        self.lock = threading.Lock()
+
+    def enter(self):
+        with self.lock:
+            self.now += 1
+            self.chunks += 1
+            self.most = max(self.most, self.now)
+
+    def leave(self):
+        with self.lock:
+            self.now -= 1
+
+
+class Transport:
+    def __init__(self):
+        self.count = Counter()
+
+    def json(self, method, path, body):
+        return {'uploadId': 'upload', 'chunkBytes': MIB} if path.endswith('/uploads') else {}
+
+    def send(self, method, path, **kwargs):
+        self.count.enter()
+        time.sleep(0.02)
+        self.count.leave()
+        return self
+
+    def read(self):
+        return b''
+
+
+class AsyncTransport(Transport):
+    async def json(self, *args, **kwargs):
+        return super().json(*args, **kwargs)
+
+    async def send(self, method, path, **kwargs):
+        self.count.enter()
+        await asyncio.sleep(0.02)
+        self.count.leave()
+        return self
+
+    async def read(self):
+        return b''
+
+
+class UploadParallel(unittest.TestCase):
+    def test_sync_keeps_eight_chunks_in_flight(self):
+        transport = Transport()
+        Files(transport, 'sandbox').write('/workspace/big.bin', b'x' * (16 * MIB))
+        self.assertEqual((transport.count.chunks, transport.count.most), (16, 8))
+
+    def test_async_keeps_eight_chunks_in_flight(self):
+        transport = AsyncTransport()
+        asyncio.run(AsyncFiles(transport, 'sandbox').write('/workspace/big.bin', b'x' * (16 * MIB)))
+        self.assertEqual((transport.count.chunks, transport.count.most), (16, 8))
+
+
+if __name__ == '__main__':
+    unittest.main()

withruntime-0.8.3/tests/test_jobs.py

@@ -0,0 +1,165 @@
+"""runtime.jobs and the jobs copy of runtime.secrets against a stub API, sync and
+async. The routes run over Postgres in packages/cloud (product-api.test.ts)."""
+import asyncio
+import json
+import threading
+import unittest
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+
+from withruntime import (AsyncRuntime, InvalidRequestError, Runtime, SecretPartlyStoredError,
+                         ServiceUnavailableError)
+
+JOB_ID = "11111111-1111-4111-8111-111111111111"
+RUN_ID = "22222222-2222-4222-8222-222222222222"
+SECRET_ID = "33333333-3333-4333-8333-333333333333"
+JOB = {"id": JOB_ID, "name": "nightly", "state": "active", "nextRunAt": 1}
+RUN = {"id": RUN_ID, "jobId": JOB_ID, "state": "succeeded", "exitCode": 0}
+COPY = {"id": SECRET_ID, "name": "DB_PASSWORD", "version": 2, "deletedAt": None}
+EGRESS = {"name": "API_TOKEN", "hosts": ["api.example.com"], "placeholder": "rtsec_x", "enforced": True}
+
+
+class Stub(BaseHTTPRequestHandler):
+    seen: list = []
+    mode = "ok"
+    copies: list = []
+
+    def log_message(self, *args):
+        pass
+
+    def answer(self, value, status=200):
+        data = json.dumps(value).encode()
+        self.send_response(status)
+        self.send_header("content-type", "application/json")
+        self.send_header("content-length", str(len(data)))
+        self.end_headers()
+        self.wfile.write(data)
+
+    def handle_any(self):
+        length = int(self.headers.get("content-length") or 0)
+        body = json.loads(self.rfile.read(length)) if length else None
+        path = self.path.split("?")[0]
+        Stub.seen.append((self.command, self.path, body, self.headers.get("idempotency-key")))
+        if Stub.mode == "off" or (Stub.mode == "jobs-off" and path.startswith("/v1/secrets")):
+            return self.answer({"error": {"code": "unavailable", "message": "This product is not enabled on this "
+                                          "deployment.", "hint": "not yet"}}, 503)
+        if path == "/v1/jobs" and self.command == "GET":
+            return self.answer({"items": [JOB], "nextCursor": None})
+        if path.endswith("/runs"):
+            return self.answer({"items": [RUN], "nextCursor": None})
+        if path.endswith("/logs"):
+            return self.answer({"chunks": [{"offset": 0, "stream": "stdout", "text": "hi\n"}], "nextCursor": 3,
+                                "truncated": False, "complete": True})
+        if path.startswith("/v1/job-runs/"):
+            return self.answer(RUN)
+        if path.startswith("/v1/jobs"):
+            return self.answer(JOB)
+        if path == "/v1/secrets" and self.command == "GET":
+            return self.answer(Stub.copies)
+        if path.endswith(":reveal"):
+            return self.answer({"id": SECRET_ID, "version": 2, "value": "hunter2"})
+        if path.startswith("/v1/secrets"):
+            return self.answer({**COPY, "version": 1})
+        if path.startswith("/v1/egress-secrets"):
+            return self.answer(EGRESS if self.command == "PUT" else {"name": "x", "deleted": True, "enforced": True})
+        self.answer({"error": {"code": "not_found", "message": "no"}}, 404)
+
+    do_GET = do_POST = do_PUT = do_DELETE = handle_any
+
+
+class JobsTest(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls):
+        cls.server = ThreadingHTTPServer(("127.0.0.1", 0), Stub)
+        threading.Thread(target=cls.server.serve_forever, daemon=True).start()
+        cls.url = f"http://127.0.0.1:{cls.server.server_address[1]}"
+
+    @classmethod
+    def tearDownClass(cls):
+        cls.server.shutdown()
+
+    def setUp(self):
+        Stub.seen, Stub.mode, Stub.copies = [], "ok", []
+
+    def client(self):
+        return Runtime(api_key="rk_test", base_url=self.url, max_retries=2)
+
+    def test_create_fills_defaults_and_every_verb_calls_its_route(self):
+        with self.client() as runtime:
+            runtime.jobs.create("nightly", cron="0 3 * * *", timezone="Europe/Berlin", command=["echo", "hi"])
+            self.assertEqual([j["id"] for j in runtime.jobs.list()], [JOB_ID])
+            self.assertEqual(runtime.jobs.runs(JOB_ID).data[0]["id"], RUN_ID)
+            self.assertEqual(runtime.jobs.run(RUN_ID)["state"], "succeeded")
+            self.assertTrue(runtime.jobs.logs(RUN_ID, cursor=0)["complete"])
+            runtime.jobs.pause(JOB_ID)
+            runtime.jobs.resume(JOB_ID)
+            runtime.jobs.cancel(JOB_ID)
+        first = Stub.seen[0]
+        self.assertEqual(first[:2], ("POST", "/v1/jobs"))
+        self.assertTrue(first[3])
+        self.assertEqual(first[2]["compute"], {"region": "us-east-vin", "vcpu": 2, "cpuMode": "shared",
+                                               "cpuFloorMillis": 50, "memoryMiB": 4096, "diskMiB": 4096,
+                                               "durationSeconds": 1860})
+        self.assertEqual(first[2]["schedule"], {"kind": "cron", "expression": "0 3 * * *",
+                                                "timezone": "Europe/Berlin"})
+        self.assertEqual([s[1].split("?")[0] for s in Stub.seen[1:]], [
+            "/v1/jobs", f"/v1/jobs/{JOB_ID}/runs", f"/v1/job-runs/{RUN_ID}", f"/v1/job-runs/{RUN_ID}/logs",
+            f"/v1/jobs/{JOB_ID}:pause", f"/v1/jobs/{JOB_ID}:resume", f"/v1/jobs/{JOB_ID}:cancel"])
+
+    def test_mistakes_are_refused_before_sending(self):
+        with self.client() as runtime:
+            for kwargs, pattern in [
+                ({"at": 1, "compute": {"vcpu": 32}}, "at most 16 vCPU"),
+                ({"at": 1, "compute": {"diskMiB": 512}}, "at least 3072 MiB"),
+                ({"cron": "0 3 * *"}, "five fields"),
+                ({"at": "tomorrow"}, "must be a time"),
+                ({}, "at= for one run or cron="),
+                ({"at": 1, "timezone": "UTC"}, "timezone goes with cron"),
+            ]:
+                with self.assertRaisesRegex(InvalidRequestError, pattern):
+                    runtime.jobs.create("x", command=["true"], **kwargs)
+        self.assertEqual(Stub.seen, [])
+
+    def test_switched_off_names_the_product_and_is_not_retried(self):
+        Stub.mode = "off"
+        with self.client() as runtime:
+            with self.assertRaises(ServiceUnavailableError) as caught:
+                runtime.jobs.list()
+        self.assertEqual(caught.exception.message, "Jobs are not enabled on this Runtime API yet.")
+        self.assertIn("retrying will not help", caught.exception.hint)
+        self.assertFalse(caught.exception.retryable)
+        self.assertEqual(len(Stub.seen), 1)
+
+    def test_secret_jobs_copy_set_rotate_reveal_delete(self):
+        with self.client() as runtime:
+            saved = runtime.secrets.set("DB_PASSWORD", value="hunter2", jobs=True)
+            self.assertEqual(saved["jobs"]["version"], 1)
+            Stub.copies = [COPY]
+            runtime.secrets.set("DB_PASSWORD", value="new", jobs=True)
+            self.assertEqual(runtime.secrets.reveal("DB_PASSWORD")["value"], "hunter2")
+            self.assertEqual(runtime.secrets.delete("DB_PASSWORD")["from"], ["sandboxes", "jobs"])
+        lines = [(s[0], s[1].split("?")[0]) for s in Stub.seen]
+        self.assertEqual(lines, [
+            ("GET", "/v1/secrets"), ("POST", "/v1/secrets"),
+            ("GET", "/v1/secrets"), ("POST", f"/v1/secrets/{SECRET_ID}:rotate"),
+            ("GET", "/v1/secrets"), ("POST", f"/v1/secrets/{SECRET_ID}:reveal"),
+            ("GET", "/v1/secrets"), ("DELETE", "/v1/egress-secrets/DB_PASSWORD"),
+            ("POST", f"/v1/secrets/{SECRET_ID}:delete")])
+        self.assertEqual(Stub.seen[3][2], {"value": "new", "expectedVersion": 2})
+
+    def test_both_copies_report_a_partial_store_and_the_retry_finishes(self):
+        Stub.mode = "jobs-off"
+
+        async def go():
+            async with AsyncRuntime(api_key="rk_test", base_url=self.url, max_retries=0) as runtime:
+                with self.assertRaises(SecretPartlyStoredError) as caught:
+                    await runtime.secrets.set("API_TOKEN", value="t", hosts=["api.example.com"], jobs=True)
+                self.assertEqual(caught.exception.details["stored"], ["sandboxes"])
+                Stub.mode = "ok"
+                saved = await runtime.secrets.set("API_TOKEN", value="t", hosts=["api.example.com"], jobs=True)
+                self.assertEqual(saved["placeholder"], "rtsec_x")
+                self.assertEqual(saved["jobs"]["version"], 1)
+        asyncio.run(go())
+
+
+if __name__ == "__main__":
+    unittest.main()

withruntime-0.8.3/tests/test_sandbox_sessions.py

@@ -0,0 +1,149 @@
+"""Sandbox sessions (ARCHITECTURE.md section 3.12) against a stub API: the
+backend makes, lists and revokes them with ``sbx.sessions``; a page's code
+drives the sandbox with ``Sandbox.from_session`` and the token alone; and the
+Blaxel adapter's ``sandbox.sessions`` and ``from_session`` map onto them. The
+routes are tested in packages/cloud (sandbox-sessions-postgres.test.ts)."""
+import asyncio
+import json
+import threading
+import unittest
+from datetime import datetime, timedelta, timezone
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+
+import withruntime.blaxel as bl
+from withruntime import AsyncSandbox, Runtime, Sandbox
+from withruntime.blaxel import NotSupportedError, SyncSandboxInstance
+
+ID = "8a1f9c2e-0d1b-4c3a-9e8f-7a6b5c4d3e2f"
+
+
+class Stub(BaseHTTPRequestHandler):
+    seen: list = []
+    sessions: list = []
+    url = ""
+
+    def log_message(self, *args):
+        pass
+
+    def answer(self, value, status=200):
+        data = json.dumps(value).encode()
+        self.send_response(status)
+        self.send_header("content-type", "application/json")
+        self.send_header("content-length", str(len(data)))
+        self.end_headers()
+        self.wfile.write(data)
+
+    def handle_any(self):
+        length = int(self.headers.get("content-length") or 0)
+        body = json.loads(self.rfile.read(length) or b"null") if length else None
+        path = self.path.split("?")[0]
+        Stub.seen.append((self.command, path, self.headers.get("authorization"), body))
+        if path == f"/v1/sandboxes/{ID}/sessions" and self.command == "POST":
+            sid = f"00000000-0000-4000-8000-{len(Stub.sessions):012d}"
+            made = {"id": sid, "sandboxId": ID, "name": None, "origins": body.get("origins", []),
+                    "createdBy": "agent", "createdAt": "2026-09-28T10:00:00Z",
+                    "expiresAt": (datetime.now(timezone.utc)
+                                  + timedelta(seconds=body.get("ttlSeconds", 3600))).isoformat(),
+                    "revokedAt": None, "state": "active"}
+            Stub.sessions.insert(0, made)
+            return self.answer({**made, "token": f"rtsess_{sid}_{'t' * 43}", "apiUrl": Stub.url})
+        if path == f"/v1/sandboxes/{ID}/sessions":
+            return self.answer({"data": Stub.sessions, "nextCursor": None})
+        if path.endswith(":revoke"):
+            sid = path.split("/")[-1].split(":")[0]
+            for one in Stub.sessions:
+                if one["id"] == sid:
+                    one.update(state="revoked", revokedAt="2026-09-28T10:30:00Z")
+                    return self.answer(one)
+            return self.answer({"error": {"code": "not_found", "status": 404, "message": "x"}}, 404)
+        if path.endswith(":exec"):
+            return self.answer({"exitCode": 0, "stdout": "hi\n", "stderr": "", "timedOut": False})
+        return self.answer({"id": ID, "name": "web", "state": "running", "labels": {}, "autoWake": True,
+                            "memoryMiB": 4096, "createdAt": "2026-09-28T10:00:00Z",
+                            "expiresAt": "2026-09-28T11:00:00Z", "onLeaseEnd": "stop"})
+
+    do_GET = do_POST = do_PUT = handle_any
+
+
+class SessionsTest(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls):
+        cls.server = ThreadingHTTPServer(("127.0.0.1", 0), Stub)
+        threading.Thread(target=cls.server.serve_forever, daemon=True).start()
+        cls.url = Stub.url = f"http://127.0.0.1:{cls.server.server_address[1]}"
+
+    @classmethod
+    def tearDownClass(cls):
+        cls.server.shutdown()
+
+    def setUp(self):
+        Stub.seen, Stub.sessions = [], []
+
+    def test_backend_makes_lists_and_revokes(self):
+        with Runtime(api_key="rtcloud_k", base_url=self.url, max_retries=0) as runtime:
+            sbx = runtime.sandboxes.get(ID)
+            made = sbx.sessions.create(ttl_seconds=900, origins=["https://app.example.com"], name="u1")
+            self.assertTrue(made["token"].startswith("rtsess_"))
+            self.assertEqual(Stub.seen[-1][3], {"ttlSeconds": 900, "origins": ["https://app.example.com"],
+                                                "name": "u1"})
+            self.assertEqual([one["id"] for one in sbx.sessions.list()], [made["id"]])
+            self.assertEqual(sbx.sessions.revoke(made["id"])["state"], "revoked")
+
+    def test_page_uses_the_token_alone(self):
+        token = f"rtsess_{'0' * 8}-0000-4000-8000-{'0' * 12}_{'t' * 43}"
+        sbx = Sandbox.from_session(token, ID, self.url)
+        self.assertEqual(Stub.seen, [])
+        self.assertEqual(sbx.exec("echo hi").stdout, "hi\n")
+        self.assertEqual(Stub.seen[-1][2], f"Bearer {token}")
+        with self.assertRaises(Exception):
+            Sandbox.from_session("rtcloud_key", ID, self.url)
+
+        async def go():
+            page = AsyncSandbox.from_session(token, ID, self.url)
+            return (await page.exec("echo hi")).stdout
+
+        self.assertEqual(asyncio.run(go()), "hi\n")
+
+    def test_blaxel_sessions_and_from_session(self):
+        runtime = Runtime(api_key="rtcloud_k", base_url=self.url, max_retries=0)
+        bl.use_client(runtime)
+        try:
+            box = SyncSandboxInstance(_runtime=runtime.sandboxes.get(ID))
+            session = box.sessions.create({
+                "expires_at": datetime.now(timezone.utc) + timedelta(minutes=15),
+                "response_headers": {"Access-Control-Allow-Origin": "https://app.example.com",
+                                     "Access-Control-Allow-Methods": "GET"}})
+            self.assertTrue(session.token.startswith("rtsess_"))
+            self.assertEqual(session.url, f"{self.url}/v1/sandboxes/{ID}")
+            self.assertEqual(Stub.seen[-1][3]["origins"], ["https://app.example.com"])
+            self.assertIn(Stub.seen[-1][3]["ttlSeconds"], (899, 900))
+            box.sessions.create()  # Blaxel's default: a day, Runtime's most.
+            self.assertEqual(Stub.seen[-1][3]["ttlSeconds"], 86_400)
+            self.assertEqual(len(box.sessions.list()), 2)
+            self.assertEqual(box.sessions.get(session.name)["url"], session.url)
+            box.sessions.delete(session.name)
+            self.assertNotIn(session.name, [one.name for one in box.sessions.list()])
+            kept = box.sessions.create_if_expired({}, delta_seconds=60)
+            self.assertEqual(box.sessions.create_if_expired({}, delta_seconds=60).token, kept.token)
+
+            page = SyncSandboxInstance.from_session(session)
+            self.assertEqual(page.metadata.name, "web")
+            self.assertTrue(any(auth == f"Bearer {session.token}" for _, _, auth, _ in Stub.seen))
+
+            before = len(Stub.seen)
+            for options in ({"response_headers": {"Access-Control-Allow-Origin": "*"}},
+                            {"response_headers": {"X-Frame-Options": "DENY"}},
+                            {"request_headers": {"Authorization": "x"}},
+                            {"expires_at": datetime.now(timezone.utc) + timedelta(days=2)}):
+                with self.assertRaises(NotSupportedError):
+                    box.sessions.create(options)
+            self.assertEqual(len(Stub.seen), before)
+            with self.assertRaises(NotSupportedError):
+                SyncSandboxInstance.from_session({"url": "https://blaxel.dev/x", "token": "bl_x"})
+        finally:
+            bl.use_client(None)
+            runtime.close()
+
+
+if __name__ == "__main__":
+    unittest.main()

{withruntime-0.8.1 → withruntime-0.8.3}/tests/test_secrets.py

@@ -39,7 +39,8 @@ class Stub(BaseHTTPRequestHandler):
 
     def do_GET(self):
         Stub.seen.append((self.command, self.path, None))
-        self.answer({"secrets": [SECRET]})
+        # The jobs copies: none here.
+        self.answer([] if self.path.startswith("/v1/secrets") else {"secrets": [SECRET]})
 
     def do_PUT(self):
         Stub.seen.append((self.command, self.path, self.body()))
@@ -75,6 +76,7 @@ class SecretsTest(unittest.TestCase):
             ("PUT", "/v1/egress-secrets/OPENAI_API_KEY", {"value": "sk-live", "hosts": ["api.openai.com"],
                                                   "header": "Authorization", "format": "Bearer {value}"}),
             ("GET", "/v1/egress-secrets", None),
+            ("GET", "/v1/secrets?limit=100", None),
             ("DELETE", "/v1/egress-secrets/OPENAI_API_KEY", None),
         ])
 

{withruntime-0.8.1 → withruntime-0.8.3}/tests/test_vercel.py

@@ -95,8 +95,9 @@ class Create(Base):
         self.assertEqual(network_rules(NetworkPolicy.deny_all()), {"internet": False})
         self.assertEqual(network_rules(NetworkPolicy.allow_all()), {"internet": True})
         self.assertEqual(network_rules(NetworkPolicy.custom()), {"internet": False})
-        with self.assertRaises(NotSupportedError):
+        with self.assertRaises(NotSupportedError) as caught:
             network_rules(NetworkPolicy.custom(allow={"api.github.com": ["rule"]}))
+        self.assertIn("withruntime secrets set NAME --host api.github.com", caught.exception.alternative)
 
 
 class Keys(unittest.TestCase):