Remove SDK-side defaults from API request payloads by devin-ai-integration[bot] · Pull Request #1749 · e2b-dev/E2B

devin-ai-integration · 2026-08-21T13:25:54Z

Summary

Remove SDK-side defaults from API request payloads (JS + Python sync/async) so omitted options are absent from requests and the API defaults apply. Explicit values — including false/0 — are still serialized unchanged.

Fields no longer preset when omitted:

sandbox create: timeout (was 300s), secure (was true), allow_internet_access
sandbox connect: timeout (was 300s)
POST /sandboxes/{id}/fork: timeout (was 300s), count (was 1)
POST /sandboxes/{id}/pause: memory (was true)
template builds: cpuCount/memoryMB (were 2 / 1024)

- secure: opts?.secure ?? true,
+ secure: opts?.secure,

- const timeoutMs = apiOpts?.timeoutMs ?? this.defaultSandboxTimeoutMs  // connect
+ const timeoutMs = apiOpts?.timeoutMs

Create/connect now use the v2 endpoints from belt #3425 (spec/openapi.yml synced via the spec/runtime-ref pin; JS + Python clients regenerated with the pinned generators):

- POST /sandboxes                      body: NewSandbox
+ POST /v2/sandboxes                   body: NewSandboxV2   // no `secure` field, envd always secured, timeout defaults to 300s
- POST /sandboxes/{id}/connect         body: ConnectSandbox   (timeout required)
+ POST /v2/sandboxes/{id}/connect      body: ConnectSandboxV2 (timeout optional, defaults to 300s)

Consequently the secure option on Sandbox.create is deprecated: it stays in the signature (JS SandboxOpts.secure, Python/desktop secure=) so existing callers keep working, but it is ignored — every sandbox is secured, so the SDK has nothing to send. Downstream packages follow: e2b-desktop (Python) no longer presets allow_internet_access=True; the code-interpreter test fixtures stop passing secure. The Python ConnectSandboxBody shim and the JS cast that worked around the required v1 connect timeout are gone too — the generated v2 models already make it optional.

Template.getBuildStatus / Template.get_build_status also stop presetting logsOffset: 0 — omitted, the query param is left out and the API default applies.

Per updated TASTE T-52 (client validation must not mirror backend business rules), the client-side fork count >= 1 pre-validation is also removed — an invalid count now surfaces as the API's own 400 error instead of a client-side InvalidArgumentError/InvalidArgumentException.

Belt #3425 is merged and exported: spec/runtime-ref is bumped to the runtime commit carrying the v2 routes, and make codegen at that pin reproduces the tracked spec and generated clients byte-for-byte. The live integration suites stay red until the API deploy with the v2 routes reaches staging/production (they 404 on /v2/sandboxes until then).

Exact-request tests added/updated in packages/js-sdk/tests/sandbox/apiDefaults.test.ts, packages/js-sdk/tests/template/apiDefaults.test.ts, and packages/python-sdk/tests/shared/{sandbox,template}/test_api_defaults.py; the msw/monkeypatch-mocked suites now intercept the v2 routes.

Usage stays the same; only the outgoing payloads/routes change:

await Sandbox.create('base')                       // POST /v2/sandboxes, no timeout/allow_internet_access sent
await Sandbox.connect(id)                          // POST /v2/sandboxes/{id}/connect, no timeout sent
await Sandbox.connect(id, { timeoutMs: 60_000 })   // timeout: 60
await Sandbox.create('base', { secure: true })     // accepted (deprecated), nothing sent

Linear: SDK-346

Link to Devin session: https://app.devin.ai/sessions/1921bb3818604f3a95b0db1272cff3cd
Open in Devin Desktop: https://app.devin.ai/desktop/session/1921bb3818604f3a95b0db1272cff3cd?variant=devin
Requested by: @mishushakov

Co-Authored-By: mish@e2b.dev <mish@e2b.dev>

devin-ai-integration · 2026-08-21T13:25:56Z

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

Disable automatic comment, CI, and merge conflict monitoring

chatgpt-codex-connector · 2026-08-21T13:25:57Z

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Credits must be used to enable repository wide code reviews.

changeset-bot · 2026-08-21T13:26:04Z

🦋 Changeset detected

Latest commit: e7306ec

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 3 packages

Name	Type
e2b	Minor
@e2b/python-sdk	Minor
@e2b/desktop-python	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

github-actions · 2026-08-21T13:27:02Z

Package Artifacts

Built from bedb6cb. Download artifacts from this workflow run.

JS SDK (e2b@2.50.1-devin-1787318715-remove-sdk-defaults.0):

npm install ./e2b-2.50.1-devin-1787318715-remove-sdk-defaults.0.tgz

CLI (@e2b/cli@2.19.2-devin-1787318715-remove-sdk-defaults.0):

npm install ./e2b-cli-2.19.2-devin-1787318715-remove-sdk-defaults.0.tgz

Code Interpreter JS SDK (@e2b/code-interpreter@2.8.1-devin-1787318715-remove-sdk-defaults.0):

npm install ./e2b-code-interpreter-2.8.1-devin-1787318715-remove-sdk-defaults.0.tgz

Desktop JS SDK (@e2b/desktop@2.4.1-devin-1787318715-remove-sdk-defaults.0):

npm install ./e2b-desktop-2.4.1-devin-1787318715-remove-sdk-defaults.0.tgz

Python SDK (e2b==2.50.0+devin.1787318715.remove.sdk.defaults):

pip install ./e2b-2.50.0+devin.1787318715.remove.sdk.defaults-py3-none-any.whl

Code Interpreter Python SDK (e2b-code-interpreter==2.10.0+devin.1787318715.remove.sdk.defaults):

pip install ./e2b_code_interpreter-2.10.0+devin.1787318715.remove.sdk.defaults-py3-none-any.whl

Desktop Python SDK (e2b-desktop==2.5.0+devin.1787318715.remove.sdk.defaults):

pip install ./e2b_desktop-2.5.0+devin.1787318715.remove.sdk.defaults-py3-none-any.whl

devin-ai-integration

TASTE.md review of the SDK-side default removal.

Checked: parity across JS / sync Python / async Python (T-1, T-2), where defaults live and how they are documented (T-47), server-owns-validation (T-52), absence-is-undefined / Optional[...] = None at the boundary (T-20), and docstring/JSDoc completeness (T-69, T-71, T-72).

The mechanics are clean and applied symmetrically across all three surfaces (UNSET in Python, omitted keys in JS), and the new tests pin both the omit and the explicit-value paths. 4 violations flagged inline, all in the documentation and validation edges rather than the payload change itself.

Not tied to a changed line:

connect/_cls_connect still applies the SDK-side 300 s default (apiOpts?.timeoutMs ?? DEFAULT_SANDBOX_TIMEOUT_MS in sandboxApi.ts, timeout or SandboxBase.default_sandbox_timeout in both Python sandbox_api.py). After this PR create/fork defer to the API while connect does not, so the same timeout knob has two different "unset" behaviours. Either move connect over too or say in the changeset why it keeps a client default.
Several new doc lines restate the server's current value in prose ("currently enabled", "currently allowed", "currently 1", "currently a full memory snapshot"). That is the drift T-47 exists to avoid, without the machine-readable @default tag that made the value greppable. If the value is worth documenting, document it as @default; if it isn't, say only that the SDK omits the field and the API decides.

Co-Authored-By: mish@e2b.dev <mish@e2b.dev>

The BYOP surface from #1688 diverged for callers that bypass the types. Python raised InvalidArgumentException on a proxy without a string address; JS rebuilt the body from the known fields, so `egressProxy` passed as a bare string sent `{}` and the caller got an API error naming a field they never left out. Mirror the guard in buildEgressProxyBody, the way buildIamBody already does for untyped token maps. Both SDKs also forwarded a null/None username or password as a JSON null, which the API rejects — `{"username": os.environ.get(...)}` on an unset variable is the way that happens. Read it as "no credentials", the same reading both already gave `egressProxy: null` itself, and normalize a null username coming back out of getInfo so SandboxEgressProxyInfo.username cannot be a null its type forbids. The get_info example published in both CHANGELOGs for 2.41.0 subscripts `info.network["egress_proxy"]`, which KeyErrors on every sandbox without a proxy — SandboxNetworkInfo is total=False and the key is only set when one is configured. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

…oxy input" This reverts commit b984e34.

Fixture sandboxes previously inherited the SDK's 300s create default; after removing SDK-side defaults they would fall back to the API's 15s default, making long-running integration tests flaky. Co-Authored-By: mish@e2b.dev <mish@e2b.dev>

mishushakov · 2026-08-21T15:06:35Z

check comments

…out default, simplify order docs Co-Authored-By: mish@e2b.dev <mish@e2b.dev>

Co-Authored-By: mish@e2b.dev <mish@e2b.dev>

cursor

Stale comment

Co-Authored-By: mish@e2b.dev <mish@e2b.dev>

cursor

Stale comment

mishushakov · 2026-09-09T12:27:57Z

resolve conflicts

Co-Authored-By: mish@e2b.dev <mish@e2b.dev>

linear-code · 2026-09-09T12:30:52Z

SDK-346

devin-ai-integration · 2026-09-09T12:30:55Z

Resolved — merged main (7f20cda). Conflicts were in the connect body (sandboxApi.ts, Python sync/async sandbox_api.py): kept the optional timeout and added main's new memory (onResume) field; ConnectSandboxBody now forwards memory. Format/lint/typecheck + api-defaults tests pass.

Co-Authored-By: mish@e2b.dev <mish@e2b.dev>

cursor

Stale comment

Security review of this PR found one high-severity issue: removing the SDK secure: true default can create unsecured sandboxes until the API-side default is deployed.

_{Sent by Cursor Security Agent: Security Reviewer}

Sync the v2 create/connect routes into spec/openapi.yml and regenerate the JS and Python API clients. Sandbox.create posts to /v2/sandboxes (NewSandboxV2, no secure field: envd access is always secured) and Sandbox.connect posts to /v2/sandboxes/{id}/connect with an optional body, so omitted timeouts fall back to the API's 300s default. Drops the secure option from create and the Python ConnectSandboxBody shim. Co-Authored-By: mish@e2b.dev <mish@e2b.dev>

Co-Authored-By: mish@e2b.dev <mish@e2b.dev>

…tests at v2 create Co-Authored-By: mish@e2b.dev <mish@e2b.dev>

Co-Authored-By: mish@e2b.dev <mish@e2b.dev>

secure stays in the create signatures (JS, Python sync/async, desktop-python) so existing callers don't hit an invalid-argument error, but it is ignored and never serialized into NewSandboxV2. Template.getBuildStatus no longer presets logsOffset=0; when omitted the API default applies. Co-Authored-By: mish@e2b.dev <mish@e2b.dev>

Co-Authored-By: mish@e2b.dev <mish@e2b.dev>

…ct spec Co-Authored-By: mish@e2b.dev <mish@e2b.dev>

Remove SDK-side defaults from API request payloads

1c4dc53

Co-Authored-By: mish@e2b.dev <mish@e2b.dev>

devin-ai-integration Bot requested a review from mishushakov as a code owner August 21, 2026 13:25

devin-ai-integration Bot assigned mishushakov Aug 21, 2026

cla-bot Bot added the cla-signed label Aug 21, 2026

devin-ai-integration Bot commented Aug 21, 2026

View reviewed changes

claude Bot reviewed Aug 21, 2026

View reviewed changes

Comment thread packages/js-sdk/src/template/index.ts

devin-ai-integration Bot and others added 2 commits August 21, 2026 14:19

Fix ruff formatting in test_api_defaults.py

b92ce2b

Co-Authored-By: mish@e2b.dev <mish@e2b.dev>

Keep SDK-side secure=true default for sandbox creation

996c679

Co-Authored-By: mish@e2b.dev <mish@e2b.dev>

mishushakov reviewed Aug 21, 2026

View reviewed changes

Comment thread packages/js-sdk/src/sandbox/sandboxApi.ts Outdated

devin-ai-integration Bot and others added 2 commits August 21, 2026 14:27

Remove redundant API-default doc mentions

ef24b64

Co-Authored-By: mish@e2b.dev <mish@e2b.dev>

mishushakov mentioned this pull request Aug 21, 2026

fix(sdk): let callers omit lifecycle.onTimeout #1711

Closed

devin-ai-integration Bot and others added 2 commits August 21, 2026 14:43

Revert "fix(sdk): match JS and Python on malformed and null egress pr…

6d991cb

…oxy input" This reverts commit b984e34.

devin-ai-integration Bot and others added 2 commits August 21, 2026 15:15

Address review: add template build payload tests, mirror connect time…

e4d7b95

…out default, simplify order docs Co-Authored-By: mish@e2b.dev <mish@e2b.dev>

Drop SDK-side connect timeout and secure defaults

a06670b

Co-Authored-By: mish@e2b.dev <mish@e2b.dev>

cursor Bot reviewed Aug 21, 2026

View reviewed changes

Comment thread packages/js-sdk/src/sandbox/sandboxApi.ts Outdated

devin-ai-integration Bot mentioned this pull request Aug 21, 2026

Remove client-side fork count validation #1753

Closed

Remove client-side fork count validation per T-52

e9963a5

Co-Authored-By: mish@e2b.dev <mish@e2b.dev>

cursor Bot reviewed Aug 21, 2026

View reviewed changes

Comment thread packages/js-sdk/src/sandbox/sandboxApi.ts Outdated

mishushakov mentioned this pull request Sep 8, 2026

fix(python): keep timeout=0 on sandbox create and connect #1842

Closed

Merge origin/main into devin/1787318715-remove-sdk-defaults

7f20cda

Co-Authored-By: mish@e2b.dev <mish@e2b.dev>

Merge origin/main into devin/1787318715-remove-sdk-defaults

947368f

Co-Authored-By: mish@e2b.dev <mish@e2b.dev>

cursor Bot reviewed Sep 9, 2026

View reviewed changes

Comment thread packages/js-sdk/src/sandbox/sandboxApi.ts Outdated

devin-ai-integration Bot and others added 5 commits September 16, 2026 12:53

Merge origin/main into devin/1787318715-remove-sdk-defaults

9a90eef

Co-Authored-By: mish@e2b.dev <mish@e2b.dev>

Drop removed secure option from downstream packages and point client …

9055c26

…tests at v2 create Co-Authored-By: mish@e2b.dev <mish@e2b.dev>

Update template build body tests for API-owned cpu/memory defaults

31c28c0

Co-Authored-By: mish@e2b.dev <mish@e2b.dev>

Drop removed secure option from sync secured-files tests

88e5b44

Co-Authored-By: mish@e2b.dev <mish@e2b.dev>

mishushakov reviewed Sep 16, 2026

View reviewed changes

Comment thread packages/desktop-python/e2b_desktop/main.py

Comment thread packages/js-sdk/src/sandbox/sandboxApi.ts

devin-ai-integration Bot and others added 5 commits September 16, 2026 13:39

Sync v2 sandbox timeout minimum from belt spec

e875d62

Co-Authored-By: mish@e2b.dev <mish@e2b.dev>

Sync v2 sandbox timeout minimum (15s) from belt spec

973a2da

Co-Authored-By: mish@e2b.dev <mish@e2b.dev>

Sync v2 sandbox timeout minimum (1s) from belt spec

0ee39e4

Co-Authored-By: mish@e2b.dev <mish@e2b.dev>

chore(spec): bump runtime-ref to the exported v2 sandbox create/conne…

e7306ec

…ct spec Co-Authored-By: mish@e2b.dev <mish@e2b.dev>

Uh oh!

Conversation

devin-ai-integration Bot commented Aug 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Uh oh!

devin-ai-integration Bot commented Aug 21, 2026

🤖 Devin AI Engineer

Uh oh!

chatgpt-codex-connector Bot commented Aug 21, 2026

Uh oh!

changeset-bot Bot commented Aug 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

Uh oh!

github-actions Bot commented Aug 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Package Artifacts

Uh oh!

devin-ai-integration Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mishushakov commented Aug 21, 2026

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

mishushakov commented Sep 9, 2026

Uh oh!

linear-code Bot commented Sep 9, 2026

Uh oh!

devin-ai-integration Bot commented Sep 9, 2026

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

devin-ai-integration Bot commented Aug 21, 2026 •

edited

Loading

changeset-bot Bot commented Aug 21, 2026 •

edited

Loading

github-actions Bot commented Aug 21, 2026 •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading