feat: sync API specs from infra and belt with Copybara

[mishushakov]

The specs in spec/ were copied from their source repos by hand and had drifted ~2,400 lines behind infra, so they are now imported with Copybara (copy.bara.sky, run in a pinned Docker image by scripts/fetch-spec.sh): make codegen re-fetches them at the commits pinned in spec/infra-ref and spec/belt-ref before generating, and the generated-files CI check fails if the tracked copies don't match the pins. Regenerating from the current pins picks up the accumulated spec changes in the generated JS/Python clients (renamed request schemas, SandboxNetworkConfig, SandboxIam workload identity, FILE_TYPE_SYMLINK, access-token auth deprecation, volume path-metadata tweaks). The one handwritten SDK change follows from that: the public FileType enums gain a SYMLINK member (JS and both Python surfaces) so entries envd reports as symlinks show up in files.list() and getInfo()/get_info() instead of being silently skipped as unknown types. The custom spec/remove_extra_tags.py tag-filtering script is replaced by Redocly CLI's filter-in decorator (redocly.yaml), which produces identical generated JS output; a filter-out decorator additionally drops any operation or component schema the upstream specs mark x-not-implemented: true (currently the SOCKS5 SandboxEgressProxyConfig/egressProxy surface, which infra flagged as spec-only); each SDK's bundle now goes to its own gitignored spec/openapi_generated.<api>.yml instead of both pipelines overwriting one shared file; Python client models now list fields in spec order instead of alphabetical (mechanical reordering only — construct models with keyword args). Spec fetches try whatever GitHub token is available and fall back to the tracked copies with a warning (the public infra specs also fetch anonymously); in CI a short-lived belt-scoped token is minted from the org-wide Autofixer GitHub App (no new secrets), so fork PRs simply fall back for the belt spec; the CI workflows also cache the Copybara image alongside the codegen image, and the previously ignored CODEGEN_IMAGE env is honored by the Makefile.

Usage

# update the specs: bump a pin, then regenerate
echo <infra-commit-sha> > spec/infra-ref
make codegen

# fetch a single spec without regenerating
pnpm fetch:api-spec     # spec/openapi.yml from infra
pnpm fetch:envd-spec    # spec/envd/ from infra
pnpm fetch:volume-spec  # spec/openapi-volumecontent.yml from belt

# try the latest spec without touching the pin
E2B_INFRA_REF=main pnpm fetch:api-spec

# change which endpoint tags an SDK exposes
$EDITOR redocly.yaml && make codegen

// symlinks are now visible in the filesystem API (JS; same shape in Python)
const entries = await sandbox.files.list('/home/user')
const link = entries.find((e) => e.type === FileType.SYMLINK)
console.log(link?.symlinkTarget)

🤖 Generated with Claude Code

[changeset-bot]

🦋 Changeset detected

Latest commit: e1c667a

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 2 packages

Name	Type
e2b	Minor
@e2b/python-sdk	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[cursor]

PR Summary

Medium Risk
Large generated-client churn and new spec-sync CI can break codegen on forks or pin drift; symlink and IAM surface changes affect runtime SDK behavior.

Overview
OpenAPI/envd/volume specs are no longer edited in-repo; make codegen runs fetch-specs (Copybara in copy.bara.sky / scripts/fetch-spec.sh) at pins in spec/infra-ref and spec/belt-ref, with CI building a Copybara image and minting a belt-scoped GitHub App token on non-fork PRs. Tag filtering and x-not-implemented stripping move from remove_extra_tags.py to redocly.yaml, with per-SDK bundles openapi_generated.js-sdk.yml / openapi_generated.python-sdk.yml. Generated REST clients pick up named timeout/snapshot/refresh bodies, SandboxIam, network config, v2 template list, and related spec drift; SOCKS5 egress marked not-implemented is omitted from clients. JS and Python sandbox filesystem layers add FileType.SYMLINK mapping and a JS unit test; Python API models use spec field order instead of alphabetical.

^{Reviewed by Cursor Bugbot for commit e1c667a. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

Package Artifacts

Built from 23e0162. Download artifacts from this workflow run.

JS SDK (e2b@2.35.4-fetch-spec-via-copybara.0):

npm install ./e2b-2.35.4-fetch-spec-via-copybara.0.tgz

CLI (@e2b/cli@2.15.1-fetch-spec-via-copybara.0):

npm install ./e2b-cli-2.15.1-fetch-spec-via-copybara.0.tgz

Python SDK (e2b==2.34.0+fetch.spec.via.copybara):

pip install ./e2b-2.34.0+fetch.spec.via.copybara-py3-none-any.whl

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9602b8a2ec

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit d253e48. Configure here.}

[linear-code]

SDK-272