Remove SDK-side defaults from API request payloads by devin-ai-integration[bot] · Pull Request #1749 · e2b-dev/E2B

devin-ai-integration · 2026-08-21T13:25:54Z

Summary

Remove SDK-side defaults from API request payloads (JS + Python sync/async) so omitted options are absent from requests and the API defaults apply. Explicit values — including false/0 — are still serialized unchanged.

Fields no longer preset when omitted:

POST /sandboxes: timeout (was 300s), secure (was true), allow_internet_access
POST /sandboxes/{id}/connect: timeout (was 300s)
POST /sandboxes/{id}/fork: timeout (was 300s), count (was 1)
POST /sandboxes/{id}/pause: memory (was true)
template builds: cpuCount/memoryMB (were 2 / 1024)

- secure: opts?.secure ?? true,
+ secure: opts?.secure,

- const timeoutMs = apiOpts?.timeoutMs ?? this.defaultSandboxTimeoutMs  // connect
+ const timeoutMs = apiOpts?.timeoutMs

Per updated TASTE T-52 (client validation must not mirror backend business rules), the client-side fork count >= 1 pre-validation is also removed — an invalid count now surfaces as the API's own 400 error instead of a client-side InvalidArgumentError/InvalidArgumentException.

The generated clients still mark connect timeout as required (spec is pinned pre-API-change), so the omission is done at the call site: a cast in JS, and a small ConnectSandboxBody subclass in Python that drops timeout from to_dict() when unset. These can be removed once the spec pin is bumped after the API-side default lands.

Note (intentionally breaking until the API changes deploy): with this PR, omitting secure creates unsecured sandboxes and omitting connect timeout is rejected by the current API. API-side defaults are in belt PRs #2057 (secure by default) and #2059 (connect default timeout).

Exact-request tests added/updated in packages/js-sdk/tests/sandbox/apiDefaults.test.ts, packages/js-sdk/tests/template/apiDefaults.test.ts, and packages/python-sdk/tests/shared/{sandbox,template}/test_api_defaults.py.

Usage stays the same; only the outgoing payloads change:

await Sandbox.create('base')                       // no timeout/secure/allow_internet_access sent
await Sandbox.connect(id)                          // no timeout sent
await Sandbox.connect(id, { timeoutMs: 60_000 })   // timeout: 60

Linear: SDK-346

Link to Devin session: https://app.devin.ai/sessions/1921bb3818604f3a95b0db1272cff3cd
Requested by: @mishushakov

Co-Authored-By: mish@e2b.dev <mish@e2b.dev>

devin-ai-integration · 2026-08-21T13:25:56Z

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

Disable automatic comment, CI, and merge conflict monitoring

chatgpt-codex-connector · 2026-08-21T13:25:57Z

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Credits must be used to enable repository wide code reviews.

changeset-bot · 2026-08-21T13:26:04Z

🦋 Changeset detected

Latest commit: e9963a5

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 2 packages

Name	Type
e2b	Minor
@e2b/python-sdk	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

github-actions · 2026-08-21T13:27:02Z

Package Artifacts

Built from c238c11. Download artifacts from this workflow run.

JS SDK (e2b@2.45.1-devin-1787318715-remove-sdk-defaults.0):

npm install ./e2b-2.45.1-devin-1787318715-remove-sdk-defaults.0.tgz

CLI (@e2b/cli@2.17.2-devin-1787318715-remove-sdk-defaults.0):

npm install ./e2b-cli-2.17.2-devin-1787318715-remove-sdk-defaults.0.tgz

Python SDK (e2b==2.45.1+devin.1787318715.remove.sdk.defaults):

pip install ./e2b-2.45.1+devin.1787318715.remove.sdk.defaults-py3-none-any.whl

devin-ai-integration

TASTE.md review of the SDK-side default removal.

Checked: parity across JS / sync Python / async Python (T-1, T-2), where defaults live and how they are documented (T-47), server-owns-validation (T-52), absence-is-undefined / Optional[...] = None at the boundary (T-20), and docstring/JSDoc completeness (T-69, T-71, T-72).

The mechanics are clean and applied symmetrically across all three surfaces (UNSET in Python, omitted keys in JS), and the new tests pin both the omit and the explicit-value paths. 4 violations flagged inline, all in the documentation and validation edges rather than the payload change itself.

Not tied to a changed line:

connect/_cls_connect still applies the SDK-side 300 s default (apiOpts?.timeoutMs ?? DEFAULT_SANDBOX_TIMEOUT_MS in sandboxApi.ts, timeout or SandboxBase.default_sandbox_timeout in both Python sandbox_api.py). After this PR create/fork defer to the API while connect does not, so the same timeout knob has two different "unset" behaviours. Either move connect over too or say in the changeset why it keeps a client default.
Several new doc lines restate the server's current value in prose ("currently enabled", "currently allowed", "currently 1", "currently a full memory snapshot"). That is the drift T-47 exists to avoid, without the machine-readable @default tag that made the value greppable. If the value is worth documenting, document it as @default; if it isn't, say only that the SDK omits the field and the API decides.

Co-Authored-By: mish@e2b.dev <mish@e2b.dev>

The BYOP surface from #1688 diverged for callers that bypass the types. Python raised InvalidArgumentException on a proxy without a string address; JS rebuilt the body from the known fields, so `egressProxy` passed as a bare string sent `{}` and the caller got an API error naming a field they never left out. Mirror the guard in buildEgressProxyBody, the way buildIamBody already does for untyped token maps. Both SDKs also forwarded a null/None username or password as a JSON null, which the API rejects — `{"username": os.environ.get(...)}` on an unset variable is the way that happens. Read it as "no credentials", the same reading both already gave `egressProxy: null` itself, and normalize a null username coming back out of getInfo so SandboxEgressProxyInfo.username cannot be a null its type forbids. The get_info example published in both CHANGELOGs for 2.41.0 subscripts `info.network["egress_proxy"]`, which KeyErrors on every sandbox without a proxy — SandboxNetworkInfo is total=False and the key is only set when one is configured. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

…oxy input" This reverts commit b984e34.

Fixture sandboxes previously inherited the SDK's 300s create default; after removing SDK-side defaults they would fall back to the API's 15s default, making long-running integration tests flaky. Co-Authored-By: mish@e2b.dev <mish@e2b.dev>

mishushakov · 2026-08-21T15:06:35Z

check comments

…out default, simplify order docs Co-Authored-By: mish@e2b.dev <mish@e2b.dev>

Co-Authored-By: mish@e2b.dev <mish@e2b.dev>

cursor

Stale comment

Co-Authored-By: mish@e2b.dev <mish@e2b.dev>

cursor · 2026-08-21T16:46:10Z

-      allow_internet_access: opts?.allowInternetAccess ?? true,
+      timeout:
+        timeoutMs === undefined ? undefined : timeoutToSeconds(timeoutMs),
+      secure: opts?.secure,


🔒 Agentic Security Review
Severity: HIGH

The SDK now omits secure unless callers set it explicitly (secure: opts?.secure), which removes the prior secure-by-default behavior at sandbox creation.

Impact: Callers that rely on defaults can unintentionally create sandboxes with weaker controller access protection while backend defaulting is not universally guaranteed, allowing unauthorized controller interaction when the endpoint is reachable.

^{Reviewed by Cursor Security Reviewer for commit e9963a5. Configure here.}

Remove SDK-side defaults from API request payloads

1c4dc53

Co-Authored-By: mish@e2b.dev <mish@e2b.dev>

devin-ai-integration Bot requested a review from mishushakov as a code owner August 21, 2026 13:25

devin-ai-integration Bot assigned mishushakov Aug 21, 2026

cla-bot Bot added the cla-signed label Aug 21, 2026

devin-ai-integration Bot commented Aug 21, 2026

View reviewed changes

claude Bot reviewed Aug 21, 2026

View reviewed changes

Comment thread packages/js-sdk/src/template/index.ts

devin-ai-integration Bot and others added 2 commits August 21, 2026 14:19

Fix ruff formatting in test_api_defaults.py

b92ce2b

Co-Authored-By: mish@e2b.dev <mish@e2b.dev>

Keep SDK-side secure=true default for sandbox creation

996c679

Co-Authored-By: mish@e2b.dev <mish@e2b.dev>

mishushakov reviewed Aug 21, 2026

View reviewed changes

Comment thread packages/js-sdk/src/sandbox/sandboxApi.ts Outdated

devin-ai-integration Bot and others added 2 commits August 21, 2026 14:27

Remove redundant API-default doc mentions

ef24b64

Co-Authored-By: mish@e2b.dev <mish@e2b.dev>

mishushakov mentioned this pull request Aug 21, 2026

fix(sdk): let callers omit lifecycle.onTimeout #1711

Closed

devin-ai-integration Bot and others added 2 commits August 21, 2026 14:43

Revert "fix(sdk): match JS and Python on malformed and null egress pr…

6d991cb

…oxy input" This reverts commit b984e34.

devin-ai-integration Bot and others added 2 commits August 21, 2026 15:15

Address review: add template build payload tests, mirror connect time…

e4d7b95

…out default, simplify order docs Co-Authored-By: mish@e2b.dev <mish@e2b.dev>

Drop SDK-side connect timeout and secure defaults

a06670b

Co-Authored-By: mish@e2b.dev <mish@e2b.dev>

cursor Bot reviewed Aug 21, 2026

View reviewed changes

Comment thread packages/js-sdk/src/sandbox/sandboxApi.ts

devin-ai-integration Bot mentioned this pull request Aug 21, 2026

Remove client-side fork count validation #1753

Closed

Remove client-side fork count validation per T-52

e9963a5

Co-Authored-By: mish@e2b.dev <mish@e2b.dev>

cursor Bot reviewed Aug 21, 2026

View reviewed changes

Navigation Menu

Uh oh!

Remove SDK-side defaults from API request payloads - #1749

Remove SDK-side defaults from API request payloads#1749
devin-ai-integration[bot] wants to merge 10 commits into
mainfrom
devin/1787318715-remove-sdk-defaults

devin-ai-integration Bot commented Aug 21, 2026 •

edited

Loading

Uh oh!

devin-ai-integration Bot commented Aug 21, 2026

Uh oh!

chatgpt-codex-connector Bot commented Aug 21, 2026

Uh oh!

changeset-bot Bot commented Aug 21, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Aug 21, 2026 •

edited

Loading

Uh oh!

devin-ai-integration Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mishushakov commented Aug 21, 2026

Uh oh!

cursor Bot left a comment •

edited

Loading

Uh oh!

Uh oh!

cursor Bot Aug 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

devin-ai-integration Bot commented Aug 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Uh oh!

devin-ai-integration Bot commented Aug 21, 2026

🤖 Devin AI Engineer

Uh oh!

chatgpt-codex-connector Bot commented Aug 21, 2026

Uh oh!

changeset-bot Bot commented Aug 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

Uh oh!

github-actions Bot commented Aug 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Package Artifacts

Uh oh!

devin-ai-integration Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mishushakov commented Aug 21, 2026

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cursor Bot Aug 21, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

devin-ai-integration Bot commented Aug 21, 2026 •

edited

Loading

changeset-bot Bot commented Aug 21, 2026 •

edited

Loading

github-actions Bot commented Aug 21, 2026 •

edited

Loading

cursor Bot left a comment •

edited

Loading