feat(python-sdk): reduce httpx.Proxy proxies to plain proxy URLs

The API-client half of the former combined commit: proxy= accepts str,
httpx.URL, and httpx.Proxy when it reduces to a plain proxy URL (auth folded
into the userinfo); inexpressible extras (custom headers, ssl_context) raise
InvalidArgumentException.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: mishushakov

.changeset/python-pyqwest-rest-transport.md

@@ -18,10 +18,13 @@ Connection-establishment failures are retried with backoff
 (`E2B_CONNECTION_RETRIES`, default 3), matching the connect-only retries of
 the previous transports.
 
-`proxy` for API calls must now be a URL string (e.g.
+`proxy` for API calls now takes a URL string (e.g.
 `proxy="http://user:pass@localhost:8030"`, scheme http, https, socks5, or
-socks5h); the richer `httpx.Proxy` objects are rejected with
-`InvalidArgumentException` rather than partially honored.
+socks5h). `httpx.URL` and `httpx.Proxy` keep working when they reduce to
+such a URL (`httpx.Proxy` auth is folded back into the URL userinfo);
+`httpx.Proxy` extras pyqwest can't express — custom headers, an
+`ssl_context` — raise `InvalidArgumentException` rather than being silently
+dropped.
 
 envd traffic (sandbox commands, filesystem, PTY, file transfers) is not
 affected and stays on its existing stack.

packages/python-sdk/e2b/api/__init__.py

@@ -81,15 +81,31 @@ async def on_response(response: Response) -> None:
 def proxy_to_url(proxy: Optional[ProxyTypes]) -> Optional[str]:
     """Narrow the ``proxy`` connection option to the proxy URL string pyqwest
     transports take (scheme http, https, socks5, or socks5h, credentials in
-    the URL userinfo). The richer ``httpx.Proxy`` objects the httpx transports
-    accepted (per-proxy auth, headers, TLS context) are rejected rather than
-    partially honored."""
+    the URL userinfo). ``httpx.URL`` and ``httpx.Proxy`` — which the httpx
+    transports accepted — are converted when they reduce to such a URL;
+    ``httpx.Proxy`` extras that don't (custom headers, an ssl_context) are
+    rejected rather than silently dropped."""
     if proxy is None:
         return None
     if isinstance(proxy, str):
         return proxy
     if isinstance(proxy, httpx.URL):
         return str(proxy)
+    if isinstance(proxy, httpx.Proxy):
+        if proxy.headers:
+            raise InvalidArgumentException(
+                "E2B API calls don't support httpx.Proxy custom headers; "
+                "pass credentials in the proxy URL instead, "
+                'e.g. proxy="http://user:pass@localhost:8030"'
+            )
+        if proxy.ssl_context is not None:
+            raise InvalidArgumentException(
+                "E2B API calls don't support httpx.Proxy ssl_context"
+            )
+        url = proxy.url
+        if proxy.auth is not None:
+            url = url.copy_with(username=proxy.auth[0], password=proxy.auth[1])
+        return str(url)
     raise InvalidArgumentException(
         "E2B API calls support only URL-string proxies, "
         'e.g. proxy="http://user:pass@localhost:8030"'

packages/python-sdk/tests/test_api_client_transport.py

@@ -1,5 +1,6 @@
 import asyncio
 import json
+import ssl
 import threading
 from concurrent.futures import ThreadPoolExecutor
 from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
@@ -54,8 +55,31 @@ def test_proxy_to_url_narrows_to_url_strings():
     assert proxy_to_url(None) is None
     assert proxy_to_url("http://127.0.0.1:9999") == "http://127.0.0.1:9999"
     assert proxy_to_url(httpx.URL("http://127.0.0.1:9999")) == "http://127.0.0.1:9999"
+
+
+def test_proxy_to_url_reduces_httpx_proxy():
+    # httpx.Proxy converts when it reduces to a plain proxy URL, with
+    # credentials (which httpx.Proxy splits off the URL) folded back into
+    # the userinfo.
+    assert proxy_to_url(httpx.Proxy("http://127.0.0.1:9999")) == "http://127.0.0.1:9999"
+    assert (
+        proxy_to_url(httpx.Proxy("http://user:pass@127.0.0.1:9999"))
+        == "http://user:pass@127.0.0.1:9999"
+    )
+    assert (
+        proxy_to_url(httpx.Proxy("http://127.0.0.1:9999", auth=("user", "pass")))
+        == "http://user:pass@127.0.0.1:9999"
+    )
+
+    # Extras pyqwest can't express are rejected rather than silently dropped.
+    with pytest.raises(InvalidArgumentException):
+        proxy_to_url(httpx.Proxy("http://127.0.0.1:9999", headers={"X-Auth": "t"}))
     with pytest.raises(InvalidArgumentException):
-        proxy_to_url(httpx.Proxy("http://127.0.0.1:9999"))
+        proxy_to_url(
+            httpx.Proxy(
+                "https://127.0.0.1:9999", ssl_context=ssl.create_default_context()
+            )
+        )
 
 
 def test_connection_retry_policy_retries_only_connection_errors():