Skip to content

feat(sandbox-mock): add @vercel/sandbox-mock package#245

Open
marc-vercel wants to merge 11 commits into
mainfrom
marc-vercel/add-sandbox-mock
Open

feat(sandbox-mock): add @vercel/sandbox-mock package#245
marc-vercel wants to merge 11 commits into
mainfrom
marc-vercel/add-sandbox-mock

Conversation

@marc-vercel

@marc-vercel marc-vercel commented Jul 13, 2026

Copy link
Copy Markdown
Collaborator

Testing code that uses @vercel/sandbox means provisioning real sandboxes — slow, network-bound, and requiring credentials. In order to do that, customers must mock the whole Sandbox object, and they cannot run the integration tests until they go live (or they use real sandboxes).

This new package, @vercel/sandbox-mock, provides a mock that aims to run a local sandbox with some constraints. We are mocking the API layer, and instead of relying into the Vercel services, we mock it by using just-bash.

We have also configured changeset to maintain version parity between @vercel/sandbox and @vercel/sandbox-mock, to ensure that users and agents install the mock with the correct signatures.

Testing

  • Each file that I have added contains unit tests (unless it is just types or interfaces).
  • There is a packages/vercel-sandbox-mock/tests/compat.test.ts test file which attempts to run the mock and real sandboxes, to ensure there is compatibility.
  • I ran the integration tests locally to ensure the compatibility tests work.

🤖 Generated with Claude Code

Add a drop-in mock of @vercel/sandbox backed by just-bash, with
compile-time contracts that keep it at parity with the SDK: multi-user
and group management, Command.durationMs, and the timeout/expiresAt
semantics. Handler-backed detached commands return a working Command.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@vercel

vercel Bot commented Jul 13, 2026

Copy link
Copy Markdown
Contributor

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
sandbox Ready Ready Preview, Comment, Open in v0 Jul 13, 2026 2:54pm
sandbox-cli Ready Ready Preview, Comment, Open in v0 Jul 13, 2026 2:54pm
sandbox-sdk-ai-example Ready Ready Preview, Comment, Open in v0 Jul 13, 2026 2:54pm
workflow-code-runner Ready Ready Preview, Comment, Open in v0 Jul 13, 2026 2:54pm

@socket-security

socket-security Bot commented Jul 13, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Addednpm/​just-bash@​3.1.0831009996100

View full report

Comment thread packages/vercel-sandbox-mock/src/session.ts Outdated
- Dedupe concurrent resumes with a shared promise, matching the real
  SDK's resumePromise guard
- Attach node-style code/syscall/path to filesystem errors so
  err.code === "ENOENT" checks behave like the real sandbox
- Honor the resume param in Sandbox.get(), eagerly resuming stopped
  sandboxes and firing onResume like the real SDK
- Validate the user exists in addUserToGroup (root and the default
  user are always allowed)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

@vercel vercel Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Additional Suggestion:

Deleting packages/vercel-sandbox-mock/.gitignore leaves the package's build output (dist/) un-ignored, so build artifacts can be accidentally committed.

Fix on Vercel

Rewrite @vercel/sandbox-mock to re-export the real @vercel/sandbox classes and
inject a mocked fetch, instead of reimplementing the SDK surface. An in-memory
MockServer serves the /v2/sandboxes HTTP contract with command execution via
just-bash, so commands, filesystem, snapshots, forking, and multi-user/group
management all exercise the real SDK code — eliminating drift and the
compile-time conformance machinery.

Also fix @vercel/sandbox: Snapshot.get now forwards a custom fetch
(WithFetchOptions), matching Snapshot.list/tree.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
marc-vercel and others added 3 commits July 13, 2026 14:49
Keep @vercel/sandbox-mock and @vercel/sandbox on the same version so
customers install a mock whose features match the SDK. Group the two as a
fixed changesets set (they always bump together), align the mock's initial
version to the SDK's 2.5.0, and add a test that errors if the versions drift.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Combine the two changesets added by this PR (the sandbox-mock addition and
the Snapshot.get fetch-forwarding fix that enables it) into one entry.

Also stop the mock's `@vercel/sandbox` peerDependency from forcing a major
bump on every SDK release: with the fixed group, that major propagated to
`@vercel/sandbox` too. Only bump peer-dependents when the new version falls
outside the existing range, so both release as a minor (2.6.0).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Fold the Snapshot.get fetch-forwarding note into the sandbox-mock changeset
so this PR carries a single entry, and only bump peer-dependents when the
release falls outside the existing range — otherwise the mock's
`@vercel/sandbox` peer forces a major that the fixed group propagates to the
SDK. Both now release together as a minor (2.6.0).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
resetHandlers() wiped the baseline handlers to [], breaking the documented
MSW-style pattern where defaults are registered once and resetHandlers()
only drops per-test use() overrides. It now restores the setupSandbox
baseline. Also document that handlers bind at sandbox start (register before
create) and that a command() regex matches only its first literal command name.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant