cloudflare/sandbox-sdk @cloudflare/sandbox@0.11.0

@cloudflare/sandbox@0.11.0

Repository: cloudflare/sandbox-sdk

Tag: @cloudflare/sandbox@0.11.0

Published: 2026-06-01T14:56:42Z

Prerelease: no

Release notes:

Minor Changes

• #708 `287ec04` Thanks @ghostwriternr! - Prevent stale preview URLs from waking or reaching sandbox runtimes. Invalid, revoked, or destroyed preview URLs return 404 INVALID_TOKEN; authorized URLs that are not activated for the current runtime return 410 STALE_PREVIEW_URL until the port is exposed again. Existing preview URLs that previously survived container restart now return 410 STALE_PREVIEW_URL after a restart until the port is exposed again in the new runtime.

getExposedPorts() and isPortExposed() now report only ports that are currently preview-forwardable in the active runtime. unexposePort() is now idempotent: revoking a port that is not currently exposed succeeds without contacting the container. Preview URL state no longer uses the container-local exposed-port registry or proxy routes.

Patch Changes

• #733 `d4a739b` Thanks @scuffi! - Allow backup and restore presigned URLs to target non-default R2 endpoints. Set BACKUP_BUCKET_ENDPOINT, for example https://.eu.r2.cloudflarestorage.com, when your backup bucket uses an R2 jurisdiction.

• #732 `8b9ec84` Thanks @ghostwriternr! - Add bridge endpoints for managing tunnels to sandbox services. HTTP clients can call POST /v1/sandbox/:id/tunnel/:port with an optional name body field for a predictable named URL, and DELETE /v1/sandbox/:id/tunnel/:port to remove the tunnel.

• #730 `de68927` Thanks @ghostwriternr! - Classify Office Open XML files such as .xlsx and .docx as binary when reading files so they are returned with base64 encoding instead of text decoding.

• #722 `95bb7b9` Thanks @aron-cf! - Add named-tunnel support to sandbox.tunnels.get(port, { name }). Named tunnels bind a user-controlled hostname (.) backed by a Cloudflare Tunnel and a proxied CNAME on your zone, so the URL is stable across container restarts and across sandboxes that share the same name. Calling sandbox.destroy() tears down the Cloudflare tunnel and DNS record alongside the container.

const tunnel = await sandbox.tunnels.get(8080, { name: 'app' });
console.log(tunnel.url); // → https://app.example.com