feat(python-sdk): carry httpx.Proxy credentials and headers into pyqwest

Supersedes the earlier reduction of proxies to plain URL strings, now that
pyqwest 0.8 has a Proxy object (curioswitch/pyqwest#194): `proxy_to_url`
becomes `proxy_to_config`, returning the URL, credentials, and proxy headers
as a tuple that both keys the transport caches and builds the `pyqwest.Proxy`.

An `httpx.Proxy`'s custom headers are no longer rejected, and its credentials
go out as `Proxy-Authorization` instead of being percent-encoded back into the
URL userinfo. A per-proxy `ssl_context` still has no counterpart and is still
rejected. The transport cache keys on the whole configuration, so the same
proxy URL with different credentials or headers gets its own pool.

`ProxyConfig` is a NamedTuple rather than a frozen dataclass because
`tests/test_env_var_parsing.py` reloads `e2b.api`: a dataclass `__eq__`
compares class identity, so keys built before and after a reload would
silently stop matching.

pyqwest 0.8 also logs requests itself on the `pyqwest.access` and `pyqwest`
loggers at DEBUG, restoring the transport-level diagnostics httpcore used to
provide; noted on `get_transport` and covered by a test, with the SDK's own
`logger` option unchanged above it.

Co-Authored-By: Claude <noreply@anthropic.com>

Author: mishushakov

.changeset/python-pyqwest-rest-transport.md

@@ -19,13 +19,27 @@ Connection-establishment failures are retried with backoff
 the previous transports. Timeouts keep raising `httpx.ReadTimeout` (an
 `httpx.TimeoutException`), as before.
 
-`proxy` for API calls now takes a URL string (e.g.
+`proxy` for API calls takes a URL string (e.g.
 `proxy="http://user:pass@localhost:8030"`, scheme http, https, socks5, or
-socks5h). `httpx.URL` and `httpx.Proxy` keep working when they reduce to
-such a URL (`httpx.Proxy` auth is folded back into the URL userinfo);
-`httpx.Proxy` extras pyqwest can't express — custom headers, an
-`ssl_context` — raise `InvalidArgumentException` rather than being silently
-dropped.
+socks5h), an `httpx.URL`, or an `httpx.Proxy` — including its credentials
+(sent as `Proxy-Authorization`) and any headers configured for the proxy. The
+one `httpx.Proxy` option pyqwest cannot express, a per-proxy `ssl_context`,
+raises `InvalidArgumentException` rather than being silently dropped.
+
+Low-level HTTP logs stay available: where enabling the `httpcore` logger used
+to show connection-level detail, pyqwest logs one line per request on the
+`pyqwest.access` logger and request lifecycle records on `pyqwest`, both at
+`DEBUG` and off unless enabled:
+
+```python
+import logging
+
+logging.basicConfig()
+logging.getLogger("pyqwest.access").setLevel(logging.DEBUG)
+# DEBUG pyqwest.access - HTTP Request: POST https://api.e2b.app/sandboxes "HTTP/2 201 Created"
+```
+
+The SDK's own `logger` option is unchanged and independent of these.
 
 envd traffic is not affected: RPC (commands, PTY, filesystem watch) already
 runs on pyqwest via `connectrpc`, and the envd HTTP API (file transfers,

packages/python-sdk/e2b/api/__init__.py

@@ -4,11 +4,12 @@
 import re
 from dataclasses import dataclass
 from types import TracebackType
-from typing import Optional, Protocol, Union
+from typing import NamedTuple, Optional, Protocol, Tuple, Union
 
 import httpx
 from httpx import AsyncBaseTransport, BaseTransport, Limits, Timeout
 from httpx._types import ProxyTypes
+from pyqwest import Proxy
 
 from e2b.api.client.client import AuthenticatedClient
 from e2b.api.client.types import Response
@@ -78,37 +79,50 @@ async def on_response(response: Response) -> None:
 pool_max_idle_per_host = int(os.getenv("E2B_MAX_KEEPALIVE_CONNECTIONS") or "20")
 
 
-def proxy_to_url(proxy: Optional[ProxyTypes]) -> Optional[str]:
-    """Narrow the ``proxy`` connection option to the proxy URL string pyqwest
-    transports take (scheme http, https, socks5, or socks5h, credentials in
-    the URL userinfo). ``httpx.URL`` and ``httpx.Proxy`` — which the httpx
-    transports accepted — are converted when they reduce to such a URL;
-    ``httpx.Proxy`` extras that don't (custom headers, an ssl_context) are
-    rejected rather than silently dropped."""
+class ProxyConfig(NamedTuple):
+    """The ``proxy`` connection option in the shape pyqwest transports take.
+
+    A tuple so it can key the transport caches directly: it is hashable and
+    compares by value, where a ``pyqwest.Proxy`` compares by identity and
+    would hand every call its own connection pool."""
+
+    url: str
+    auth: Optional[Tuple[str, str]] = None
+    headers: Tuple[Tuple[str, str], ...] = ()
+
+    def to_pyqwest(self) -> Proxy:
+        """The ``pyqwest.Proxy`` to hand a transport."""
+        return Proxy(self.url, auth=self.auth, headers=self.headers or None)
+
+
+def proxy_to_config(proxy: Optional[ProxyTypes]) -> Optional[ProxyConfig]:
+    """Convert the ``proxy`` connection option — a URL string, an
+    ``httpx.URL``, or an ``httpx.Proxy`` — to the proxy configuration pyqwest
+    transports take: a proxy URL (scheme http, https, socks5, or socks5h,
+    credentials allowed in the userinfo), basic-auth credentials, and headers
+    to send to the proxy. An ``httpx.Proxy`` ``ssl_context`` has no pyqwest
+    counterpart and is rejected rather than silently dropped."""
     if proxy is None:
         return None
     if isinstance(proxy, str):
-        return proxy
+        return ProxyConfig(proxy)
     if isinstance(proxy, httpx.URL):
-        return str(proxy)
+        return ProxyConfig(str(proxy))
     if isinstance(proxy, httpx.Proxy):
-        if proxy.headers:
-            raise InvalidArgumentException(
-                "E2B API calls don't support httpx.Proxy custom headers; "
-                "pass credentials in the proxy URL instead, "
-                'e.g. proxy="http://user:pass@localhost:8030"'
-            )
         if proxy.ssl_context is not None:
             raise InvalidArgumentException(
                 "E2B API calls don't support httpx.Proxy ssl_context"
             )
-        url = proxy.url
-        if proxy.auth is not None:
-            url = url.copy_with(username=proxy.auth[0], password=proxy.auth[1])
-        return str(url)
+        # httpx.Proxy splits userinfo out of the URL into `.auth`; pyqwest
+        # takes the credentials the same way, so they pass straight through.
+        return ProxyConfig(
+            str(proxy.url),
+            auth=proxy.auth,
+            headers=tuple(proxy.headers.items()),
+        )
     raise InvalidArgumentException(
-        "E2B API calls support only URL-string proxies, "
-        'e.g. proxy="http://user:pass@localhost:8030"'
+        "E2B API calls support only URL-string, httpx.URL, and httpx.Proxy "
+        'proxies, e.g. proxy="http://user:pass@localhost:8030"'
     )
 
 

packages/python-sdk/e2b/api/client_async/__init__.py

@@ -12,11 +12,12 @@
 
 from e2b.api import (
     AsyncApiClient,
+    ProxyConfig,
     connection_retries,
     limits,
     pool_idle_timeout,
     pool_max_idle_per_host,
-    proxy_to_url,
+    proxy_to_config,
 )
 from e2b.connection_config import ConnectionConfig
 
@@ -71,29 +72,34 @@ def should_retry_response(
 # pyqwest's I/O runs on its own Rust runtime, so unlike the httpx envd
 # transports below, the transport is not bound to an event loop and the
 # cache is process-global rather than per-loop.
-_transports: Dict[Optional[str], "AsyncApiPyqwestTransport"] = {}
+_transports: Dict[Optional[ProxyConfig], "AsyncApiPyqwestTransport"] = {}
 
 
 def get_transport(config: ConnectionConfig) -> "AsyncApiPyqwestTransport":
     """The shared pyqwest-backed httpx transport for REST API calls. For TLS
     connections ALPN negotiates the HTTP version (HTTP/2 against the E2B
-    API), like the http2-enabled httpx transport this replaced."""
-    proxy_url = proxy_to_url(config.proxy)
+    API), like the http2-enabled httpx transport this replaced.
+
+    Requests are logged by pyqwest itself on the ``pyqwest.access`` and
+    ``pyqwest`` loggers at ``DEBUG`` (off unless enabled) — the transport-level
+    diagnostics httpcore used to provide. The SDK's own ``logger`` option is
+    separate and sits above this, on the httpx client."""
+    proxy = proxy_to_config(config.proxy)
     with _transport_lock:
-        transport = _transports.get(proxy_url)
+        transport = _transports.get(proxy)
         if transport is None:
             transport = AsyncApiPyqwestTransport(
                 ConnectionRetryTransport(
                     HTTPTransport(
                         tls_include_system_certs=True,
-                        proxy=proxy_url,
+                        proxy=proxy.to_pyqwest() if proxy is not None else None,
                         pool_idle_timeout=pool_idle_timeout,
                         pool_max_idle_per_host=pool_max_idle_per_host,
                     ),
                     max_retries=connection_retries,
                 )
             )
-            _transports[proxy_url] = transport
+            _transports[proxy] = transport
         return transport
 
 

packages/python-sdk/e2b/api/client_sync/__init__.py

@@ -10,11 +10,12 @@
 
 from e2b.api import (
     ApiClient,
+    ProxyConfig,
     connection_retries,
     limits,
     pool_idle_timeout,
     pool_max_idle_per_host,
-    proxy_to_url,
+    proxy_to_config,
 )
 from e2b.connection_config import ConnectionConfig
 
@@ -66,29 +67,34 @@ def should_retry_response(
 # One transport (= one connection pool) per proxy; None is the direct pool.
 # pyqwest transports are thread-safe, so unlike the httpx envd transports
 # below, the cache is process-global rather than per-thread.
-_transports: Dict[Optional[str], "ApiPyqwestTransport"] = {}
+_transports: Dict[Optional[ProxyConfig], "ApiPyqwestTransport"] = {}
 
 
 def get_transport(config: ConnectionConfig) -> "ApiPyqwestTransport":
     """The shared pyqwest-backed httpx transport for REST API calls. For TLS
     connections ALPN negotiates the HTTP version (HTTP/2 against the E2B
-    API), like the http2-enabled httpx transport this replaced."""
-    proxy_url = proxy_to_url(config.proxy)
+    API), like the http2-enabled httpx transport this replaced.
+
+    Requests are logged by pyqwest itself on the ``pyqwest.access`` and
+    ``pyqwest`` loggers at ``DEBUG`` (off unless enabled) — the transport-level
+    diagnostics httpcore used to provide. The SDK's own ``logger`` option is
+    separate and sits above this, on the httpx client."""
+    proxy = proxy_to_config(config.proxy)
     with _transport_lock:
-        transport = _transports.get(proxy_url)
+        transport = _transports.get(proxy)
         if transport is None:
             transport = ApiPyqwestTransport(
                 ConnectionRetryTransport(
                     SyncHTTPTransport(
                         tls_include_system_certs=True,
-                        proxy=proxy_url,
+                        proxy=proxy.to_pyqwest() if proxy is not None else None,
                         pool_idle_timeout=pool_idle_timeout,
                         pool_max_idle_per_host=pool_max_idle_per_host,
                     ),
                     max_retries=connection_retries,
                 )
             )
-            _transports[proxy_url] = transport
+            _transports[proxy] = transport
         return transport
 
 

packages/python-sdk/pyproject.toml

@@ -18,7 +18,7 @@ dependencies = [
     "dockerfile-parse>=2.0.1,<3",
     "rich>=14.0.0",
     "connectrpc>=0.11.1,<0.12",
-    "pyqwest>=0.7.0,<0.8",
+    "pyqwest>=0.8.0,<0.9",
 ]
 
 [project.urls]