fix(sandbox-pools): expose pool network policy across SDKs and release 0.5.90 - #873
Merged
Conversation
calavera
approved these changes
Jul 28, 2026
Release the sandbox pool network policy change across the Python, Rust, and TypeScript SDKs at the shared version 0.5.90. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
sgirones
changed the title
diptanu
added a commit
that referenced
this pull request
Jul 29, 2026
…e, release 0.5.91 (#876) ## Summary compute-engine-internal#1500 taught the service to recycle a pool's unclaimed warm containers when its network policy changes and to enforce the policy match at claim time. That removes the reason #873 made the policy create-only in the SDKs, so this PR lets users replace a pool's network policy through `update_pool` across all three SDKs. Semantics are the same everywhere: **omit `network` to keep the pool's current policy, set it to replace the policy, or clear it to remove the policy entirely.** On replacement, the service recycles the pool's unclaimed warm containers onto the new policy, while containers already claimed by sandboxes keep the policy they booted with. - **Rust**: `update_pool_with_network(pool_id, &UpdateSandboxPoolRequest)` with a `NetworkPolicyUpdate { Keep, Clear, Set(..) }` enum — `Keep` omits the field, `Clear` sends `null`, `Set` sends the object. `update_pool` keeps its keep-current behavior and delegates, staying source-compatible. - **Python**: `update_pool` gains `network` on both sync and async clients, accepting a `NetworkConfig`, omission, or the new `CLEAR_NETWORK_POLICY` sentinel. - **TypeScript**: `UpdatePoolOptions.network` accepts `NetworkConfig | null`; the "Network policy updates are not supported" throw is removed. - Docstrings and the README no longer instruct users to create a new pool to change the policy. ## Validation - `cargo test -p tensorlake` — includes a wire-shape test pinning Keep/Clear/Set to omitted/`null`/object with round-trip decode, and HTTP tests asserting neither replace nor clear performs a current-policy GET - `cargo check -p tensorlake-rust-cloud-sdk-py` / `-node` - `cargo fmt --all`; `cargo clippy -p tensorlake --all-targets` (one pre-existing `type_complexity` warning in `artifact_storage`, same as #873) - TypeScript: `npm run typecheck`; 60/60 client tests (throw test replaced by replace / omit-keeps / explicit-null-clears tests) - Python rust-backend tests: 95 passed (update-body coverage for all three modes, on both sync and async clients) - Live service tests not run (no Tensorlake credentials in this environment) ## Release Bumps 0.5.90 → 0.5.91 via `python .github/scripts/bump_version.py 0.5.91`; `Cargo.lock` regenerated with `cargo update -w` (workspace entries only); `typescript/package-lock.json` version fields synced via `npm install --package-lock-only`. After merge, dispatch the four release workflows against `main` as usual. ##⚠️ Deploy ordering Ship **compute-engine-internal#1500 to production before releasing this SDK version**. Against an older server, a policy update from this SDK changes the pool record without recycling warm containers — the exact hole #1500 closes. compute-engine-internal#1509 (absent vs null on the update route) is **not** required for this SDK to be correct: `Keep` is still resolved client-side into the current policy, so keep-current works against any server version, and `Clear` sends an explicit `null`, which older servers also treat as a clear. Once #1509 is universally deployed, a later SDK release can drop the resolve-Keep read entirely. ## Post-deploy validation - Create a pool with `allow_internet_access=True`, then update it to `allow_internet_access=False`. - Confirm the pool read returns the new policy and warm containers are replaced (pool container list turns over). - Claim a sandbox and confirm an external HTTP request fails. - Update the pool again *without* `network` and confirm the policy is unchanged. - Clear the policy (`CLEAR_NETWORK_POLICY` / `null`) and confirm the pool read returns no policy and external access works again. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Sandbox pool users can now set a network policy before the service creates warm containers. The Rust, Python, and TypeScript SDKs send
networkduring pool creation and expose the returnednetwork_policy.The SDK keeps the current policy during pool configuration updates. A user must create a new pool to change the policy. This design prevents an update from removing a policy without replacing the existing warm containers.
The Rust SDK keeps
SandboxPoolRequestsource compatible. It uses a create-only request type for the new field.Validation
cargo test -p tensorlakecargo check -p tensorlake-rust-cloud-sdk-pycargo check -p tensorlake-rust-cloud-sdk-nodecargo fmt --all -- --checkcargo clippy -p tensorlake --all-targetsnpm run typechecknpm run build:sdkClippy reports one existing
type_complexitywarning inartifact_storage. ESLint cannot run because this repository does not have an ESLint v9 configuration file. Live service tests did not run because the required Tensorlake credentials are not available.Release
This PR bumps the shared SDK version from
0.5.89to0.5.90so the network policy change ships without a separate release PR.python .github/scripts/bump_version.py 0.5.90updated:pyproject.toml— public Python SDK on PyPICargo.toml— Rust workspace version, inherited bytensorlake,tensorlake-cli, and the Node/Python native SDK cratescrates/gsvc-fs-client/Cargo.tomlcrates/rust-cloud-sdk-py/pyproject.tomltypescript/package.json— npm SDK manifestCargo.lockwas regenerated withcargo update -w, which touched only the five workspace entries.typescript/package-lock.jsoncarries the two version fields, matching the previous bump in #872.After this merges to
main, dispatch the fourworkflow_dispatchrelease workflows againstmain:publish_pypi.yaml,publish_crates_io.yaml,publish_npm.yaml, andpublish_cli.yaml. They read the version from the files above, so they must run after the bump lands.Post-Deploy Monitoring & Validation
allow_internet_access=False.network_policycontains the requested policy.A missing
network_policyor successful external access is a failure. Stop claims from the affected pool and create a replacement pool with the correct policy. Revert the SDK release if request serialization caused the failure. Because the pool policy is create-only by design, existing pools keep whatever policy they were created with, so rollback also means recreating any affected pool.