feat(mux): expose CIDR egress rules on the network policy API (#10269)

Author: stainless-app[bot]

.stats.yml

@@ -1,4 +1,4 @@
 configured_endpoints: 119
-openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/runloop-ai/runloop-0e8f05634e48dcbabeafbb1ab71297b2c506f028ffc92a1f01767147e1244a77.yml
-openapi_spec_hash: 46d01fb341301ea07b9860151d9043f7
-config_hash: 9f32651e6269089b5d6c33594b992232
+openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/runloop-ai/runloop-53098c6f2c4d6e31f36a6975b3f7f504ad3f8fbe5a209dac9b2304afcd053a77.yml
+openapi_spec_hash: 05dcd360988cd1044b6a7ab03933a5ef
+config_hash: 218b8d25038e627faab98532392ee9a0

api.md

@@ -419,10 +419,12 @@ Types:
 
 ```python
 from runloop_api_client.types import (
+    AllowedCidr,
     NetworkPolicyCreateParameters,
     NetworkPolicyListView,
     NetworkPolicyUpdateParameters,
     NetworkPolicyView,
+    PortRule,
 )
 ```
 

src/runloop_api_client/resources/network_policies.py

@@ -2,7 +2,7 @@
 
 from __future__ import annotations
 
-from typing import Optional
+from typing import Iterable, Optional
 
 import httpx
 
@@ -19,6 +19,7 @@
 )
 from ..pagination import SyncNetworkPoliciesCursorIDPage, AsyncNetworkPoliciesCursorIDPage
 from .._base_client import AsyncPaginator, make_request_options
+from ..types.allowed_cidr_param import AllowedCidrParam
 from ..types.network_policy_view import NetworkPolicyView
 
 __all__ = ["NetworkPoliciesResource", "AsyncNetworkPoliciesResource"]
@@ -52,6 +53,7 @@ def create(
         allow_all: Optional[bool] | Omit = omit,
         allow_devbox_to_devbox: Optional[bool] | Omit = omit,
         allow_mcp_gateway: Optional[bool] | Omit = omit,
+        allowed_cidrs: Optional[Iterable[AllowedCidrParam]] | Omit = omit,
         allowed_hostnames: Optional[SequenceNotStr[str]] | Omit = omit,
         description: Optional[str] | Omit = omit,
         # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
@@ -84,6 +86,10 @@ def create(
           allow_mcp_gateway: (Optional) If true, allows devbox egress to the MCP hub for MCP server access.
               Defaults to false.
 
+          allowed_cidrs: (Optional) IPv4 CIDR-based allow list with optional port restrictions, additive
+              with allowed_hostnames. Example: [{'cidr': '10.12.0.0/16', 'ports': [{'port':
+              443}]}].
+
           allowed_hostnames: (Optional) DNS-based allow list with wildcard support. Examples: ['github.com',
               '*.npmjs.org'].
 
@@ -108,6 +114,7 @@ def create(
                     "allow_all": allow_all,
                     "allow_devbox_to_devbox": allow_devbox_to_devbox,
                     "allow_mcp_gateway": allow_mcp_gateway,
+                    "allowed_cidrs": allowed_cidrs,
                     "allowed_hostnames": allowed_hostnames,
                     "description": description,
                 },
@@ -164,6 +171,7 @@ def update(
         allow_all: Optional[bool] | Omit = omit,
         allow_devbox_to_devbox: Optional[bool] | Omit = omit,
         allow_mcp_gateway: Optional[bool] | Omit = omit,
+        allowed_cidrs: Optional[Iterable[AllowedCidrParam]] | Omit = omit,
         allowed_hostnames: Optional[SequenceNotStr[str]] | Omit = omit,
         description: Optional[str] | Omit = omit,
         name: Optional[str] | Omit = omit,
@@ -188,6 +196,9 @@ def update(
 
           allow_mcp_gateway: If true, allows devbox egress to the MCP hub.
 
+          allowed_cidrs: Updated IPv4 CIDR-based allow list with optional port restrictions, additive
+              with allowed_hostnames.
+
           allowed_hostnames: Updated DNS-based allow list with wildcard support. Examples: ['github.com',
               '*.npmjs.org'].
 
@@ -215,6 +226,7 @@ def update(
                     "allow_all": allow_all,
                     "allow_devbox_to_devbox": allow_devbox_to_devbox,
                     "allow_mcp_gateway": allow_mcp_gateway,
+                    "allowed_cidrs": allowed_cidrs,
                     "allowed_hostnames": allowed_hostnames,
                     "description": description,
                     "name": name,
@@ -365,6 +377,7 @@ async def create(
         allow_all: Optional[bool] | Omit = omit,
         allow_devbox_to_devbox: Optional[bool] | Omit = omit,
         allow_mcp_gateway: Optional[bool] | Omit = omit,
+        allowed_cidrs: Optional[Iterable[AllowedCidrParam]] | Omit = omit,
         allowed_hostnames: Optional[SequenceNotStr[str]] | Omit = omit,
         description: Optional[str] | Omit = omit,
         # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
@@ -397,6 +410,10 @@ async def create(
           allow_mcp_gateway: (Optional) If true, allows devbox egress to the MCP hub for MCP server access.
               Defaults to false.
 
+          allowed_cidrs: (Optional) IPv4 CIDR-based allow list with optional port restrictions, additive
+              with allowed_hostnames. Example: [{'cidr': '10.12.0.0/16', 'ports': [{'port':
+              443}]}].
+
           allowed_hostnames: (Optional) DNS-based allow list with wildcard support. Examples: ['github.com',
               '*.npmjs.org'].
 
@@ -421,6 +438,7 @@ async def create(
                     "allow_all": allow_all,
                     "allow_devbox_to_devbox": allow_devbox_to_devbox,
                     "allow_mcp_gateway": allow_mcp_gateway,
+                    "allowed_cidrs": allowed_cidrs,
                     "allowed_hostnames": allowed_hostnames,
                     "description": description,
                 },
@@ -477,6 +495,7 @@ async def update(
         allow_all: Optional[bool] | Omit = omit,
         allow_devbox_to_devbox: Optional[bool] | Omit = omit,
         allow_mcp_gateway: Optional[bool] | Omit = omit,
+        allowed_cidrs: Optional[Iterable[AllowedCidrParam]] | Omit = omit,
         allowed_hostnames: Optional[SequenceNotStr[str]] | Omit = omit,
         description: Optional[str] | Omit = omit,
         name: Optional[str] | Omit = omit,
@@ -501,6 +520,9 @@ async def update(
 
           allow_mcp_gateway: If true, allows devbox egress to the MCP hub.
 
+          allowed_cidrs: Updated IPv4 CIDR-based allow list with optional port restrictions, additive
+              with allowed_hostnames.
+
           allowed_hostnames: Updated DNS-based allow list with wildcard support. Examples: ['github.com',
               '*.npmjs.org'].
 
@@ -528,6 +550,7 @@ async def update(
                     "allow_all": allow_all,
                     "allow_devbox_to_devbox": allow_devbox_to_devbox,
                     "allow_mcp_gateway": allow_mcp_gateway,
+                    "allowed_cidrs": allowed_cidrs,
                     "allowed_hostnames": allowed_hostnames,
                     "description": description,
                     "name": name,

src/runloop_api_client/types/__init__.py

@@ -17,12 +17,14 @@
     LifecycleConfiguration as LifecycleConfiguration,
 )
 from .axon_view import AxonView as AxonView
+from .port_rule import PortRule as PortRule
 from .agent_view import AgentView as AgentView
 from .devbox_view import DevboxView as DevboxView
 from .object_view import ObjectView as ObjectView
 from .secret_view import SecretView as SecretView
 from .tunnel_view import TunnelView as TunnelView
 from .account_view import AccountView as AccountView
+from .allowed_cidr import AllowedCidr as AllowedCidr
 from .input_context import InputContext as InputContext
 from .scenario_view import ScenarioView as ScenarioView
 from .axon_list_view import AxonListView as AxonListView
@@ -31,6 +33,7 @@
 from .agent_list_view import AgentListView as AgentListView
 from .axon_event_view import AxonEventView as AxonEventView
 from .mcp_config_view import McpConfigView as McpConfigView
+from .port_rule_param import PortRuleParam as PortRuleParam
 from .pty_tunnel_view import PtyTunnelView as PtyTunnelView
 from .axon_list_params import AxonListParams as AxonListParams
 from .devbox_list_view import DevboxListView as DevboxListView
@@ -42,6 +45,7 @@
 from .secret_list_view import SecretListView as SecretListView
 from .agent_list_params import AgentListParams as AgentListParams
 from .scenario_run_view import ScenarioRunView as ScenarioRunView
+from .allowed_cidr_param import AllowedCidrParam as AllowedCidrParam
 from .axon_create_params import AxonCreateParams as AxonCreateParams
 from .benchmark_job_view import BenchmarkJobView as BenchmarkJobView
 from .benchmark_run_view import BenchmarkRunView as BenchmarkRunView

src/runloop_api_client/types/allowed_cidr.py

@@ -0,0 +1,21 @@
+# File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+from typing import List, Optional
+
+from .._models import BaseModel
+from .port_rule import PortRule
+
+__all__ = ["AllowedCidr"]
+
+
+class AllowedCidr(BaseModel):
+    """A CIDR-based egress allow rule with optional port restrictions."""
+
+    cidr: str
+    """IPv4 CIDR block in canonical form (host bits zero), e.g. '10.12.0.0/16'."""
+
+    ports: Optional[List[PortRule]] = None
+    """(Optional) Ports allowed for this CIDR.
+
+    Empty or omitted means all ports and protocols.
+    """

src/runloop_api_client/types/allowed_cidr_param.py

@@ -0,0 +1,23 @@
+# File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+from __future__ import annotations
+
+from typing import Iterable, Optional
+from typing_extensions import Required, TypedDict
+
+from .port_rule_param import PortRuleParam
+
+__all__ = ["AllowedCidrParam"]
+
+
+class AllowedCidrParam(TypedDict, total=False):
+    """A CIDR-based egress allow rule with optional port restrictions."""
+
+    cidr: Required[str]
+    """IPv4 CIDR block in canonical form (host bits zero), e.g. '10.12.0.0/16'."""
+
+    ports: Optional[Iterable[PortRuleParam]]
+    """(Optional) Ports allowed for this CIDR.
+
+    Empty or omitted means all ports and protocols.
+    """

src/runloop_api_client/types/network_policy_create_params.py

@@ -2,10 +2,11 @@
 
 from __future__ import annotations
 
-from typing import Optional
+from typing import Iterable, Optional
 from typing_extensions import Required, TypedDict
 
 from .._types import SequenceNotStr
+from .allowed_cidr_param import AllowedCidrParam
 
 __all__ = ["NetworkPolicyCreateParams"]
 
@@ -42,6 +43,13 @@ class NetworkPolicyCreateParams(TypedDict, total=False):
     Defaults to false.
     """
 
+    allowed_cidrs: Optional[Iterable[AllowedCidrParam]]
+    """
+    (Optional) IPv4 CIDR-based allow list with optional port restrictions, additive
+    with allowed_hostnames. Example: [{'cidr': '10.12.0.0/16', 'ports': [{'port':
+    443}]}].
+    """
+
     allowed_hostnames: Optional[SequenceNotStr[str]]
     """(Optional) DNS-based allow list with wildcard support.
 

src/runloop_api_client/types/network_policy_update_params.py

@@ -2,10 +2,11 @@
 
 from __future__ import annotations
 
-from typing import Optional
+from typing import Iterable, Optional
 from typing_extensions import TypedDict
 
 from .._types import SequenceNotStr
+from .allowed_cidr_param import AllowedCidrParam
 
 __all__ = ["NetworkPolicyUpdateParams"]
 
@@ -23,6 +24,12 @@ class NetworkPolicyUpdateParams(TypedDict, total=False):
     allow_mcp_gateway: Optional[bool]
     """If true, allows devbox egress to the MCP hub."""
 
+    allowed_cidrs: Optional[Iterable[AllowedCidrParam]]
+    """
+    Updated IPv4 CIDR-based allow list with optional port restrictions, additive
+    with allowed_hostnames.
+    """
+
     allowed_hostnames: Optional[SequenceNotStr[str]]
     """Updated DNS-based allow list with wildcard support.
 

src/runloop_api_client/types/network_policy_view.py

@@ -3,6 +3,7 @@
 from typing import List, Optional
 
 from .._models import BaseModel
+from .allowed_cidr import AllowedCidr
 
 __all__ = ["NetworkPolicyView", "Egress"]
 
@@ -25,6 +26,12 @@ class Egress(BaseModel):
     allow_mcp_gateway: bool
     """If true, allows devbox egress to the MCP hub for MCP server access."""
 
+    allowed_cidrs: List[AllowedCidr]
+    """
+    CIDR-based allow list with optional port restrictions, additive with
+    allowed_hostnames.
+    """
+
     allowed_hostnames: List[str]
     """DNS-based allow list with wildcard support.
 

src/runloop_api_client/types/port_rule.py

@@ -0,0 +1,24 @@
+# File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+from typing import Optional
+from typing_extensions import Literal
+
+from .._models import BaseModel
+
+__all__ = ["PortRule"]
+
+
+class PortRule(BaseModel):
+    """A port or port range allowed for a CIDR egress rule."""
+
+    port: int
+    """The allowed port (1-65535), or the start of a port range."""
+
+    end_port: Optional[int] = None
+    """(Optional) Inclusive end of the port range (port-65535).
+
+    Omit for a single port.
+    """
+
+    protocol: Optional[Literal["TCP", "UDP"]] = None
+    """L4 protocol for a port rule."""