From b832b28ec36022dad6a92ab9fa453b48e06db04c Mon Sep 17 00:00:00 2001
From: Chad Retz <chad.retz@baseten.co>
Date: Fri, 13 Nov 2026 11:41:36 -0600
Subject: [PATCH] Remove sandbox show_secrets option

---
 baseten/sandbox/_client.py   | 17 ++++-------------
 baseten/sandbox/_info.py     |  3 +--
 tests/sandbox/test_client.py | 11 -----------
 tests/sandbox/test_e2e.py    | 18 ------------------
 4 files changed, 5 insertions(+), 44 deletions(-)

diff --git a/baseten/sandbox/_client.py b/baseten/sandbox/_client.py
index 233da78..f8bdbc4 100644
--- a/baseten/sandbox/_client.py
+++ b/baseten/sandbox/_client.py
@@ -362,22 +362,17 @@ def create(
         info = sandbox_info_from_api(sandbox)
         return SandboxCreateResult(self._sandbox_context(info.name, info.url), info)
 
-    def get_info(self, *, name: str, show_secrets: bool | None = None) -> SandboxInfo:
+    def get_info(self, *, name: str) -> SandboxInfo:
         """Get a sandbox's current record.
 
         Args:
             name: Name of the sandbox.
-            show_secrets: Reveal environment variable values for workspace
-                administrators. Defaults to false. Callers without the admin
-                role receive masked values even when true.
         """
         with self._control_api() as api:
             sandbox = api.get_sandbox(
                 sandbox_name=name,
                 params=baseten.client.managementapi.GetSandboxParams(
-                    **set_fields(
-                        team_id=self._options.team_id, show_secrets=show_secrets
-                    )
+                    **set_fields(team_id=self._options.team_id)
                 ),
             )
         return sandbox_info_from_api(sandbox)
@@ -742,17 +737,13 @@ async def create(
             self._sandbox_context(info.name, info.url), info
         )
 
-    async def get_info(
-        self, *, name: str, show_secrets: bool | None = None
-    ) -> SandboxInfo:
+    async def get_info(self, *, name: str) -> SandboxInfo:
         """Get a sandbox's current record. As :meth:`SandboxClient.get_info`."""
         with self._control_api() as api:
             sandbox = await api.get_sandbox(
                 sandbox_name=name,
                 params=baseten.client.managementapi.GetSandboxParams(
-                    **set_fields(
-                        team_id=self._options.team_id, show_secrets=show_secrets
-                    )
+                    **set_fields(team_id=self._options.team_id)
                 ),
             )
         return sandbox_info_from_api(sandbox)
diff --git a/baseten/sandbox/_info.py b/baseten/sandbox/_info.py
index b2d6f25..0d110cf 100644
--- a/baseten/sandbox/_info.py
+++ b/baseten/sandbox/_info.py
@@ -52,8 +52,7 @@ class SandboxEnvValue:
     secret: bool | None = None
     """Whether the value is a secret. Defaults to true.
 
-    Secret values come back masked as ``"****"``, unless read with
-    ``show_secrets``.
+    Secret values come back masked as ``"****"``.
     """
 
 
diff --git a/tests/sandbox/test_client.py b/tests/sandbox/test_client.py
index 52fa076..2cceea0 100644
--- a/tests/sandbox/test_client.py
+++ b/tests/sandbox/test_client.py
@@ -216,17 +216,6 @@ def test_omits_team_id_when_unset(self) -> None:
         api.client().get_info(name="sbx")
         assert "team_id" not in api.requests[0].url.params
 
-    def test_gets_info_with_show_secrets_only_when_set(self) -> None:
-        api = _Api()
-        api.route("GET", "/v1/sandboxes/instances/sbx", _record())
-        client = api.client()
-        client.get_info(name="sbx")
-        client.get_info(name="sbx", show_secrets=True)
-        assert [r.url.params.get("show_secrets") for r in api.requests] == [
-            None,
-            "true",
-        ]
-
     def test_gets_sandbox_by_name_with_call_and_from_record_without(self) -> None:
         api = _Api()
         api.route("GET", "/v1/sandboxes/instances/sbx", _record())
diff --git a/tests/sandbox/test_e2e.py b/tests/sandbox/test_e2e.py
index 8bc3e4f..40cd2a9 100644
--- a/tests/sandbox/test_e2e.py
+++ b/tests/sandbox/test_e2e.py
@@ -176,24 +176,6 @@ async def test_gets_record(
     }
 
 
-@pytest.mark.asyncio
-async def test_gets_record_with_secrets_revealed(
-    client: SandboxClient | AsyncSandboxClient, shared: _Shared
-) -> None:
-    # The e2e key is a workspace admin, so secrets are revealed.
-    if isinstance(client, SandboxClient):
-        info = await asyncio.to_thread(
-            client.get_info, name=shared.name, show_secrets=True
-        )
-    else:
-        info = await client.get_info(name=shared.name, show_secrets=True)
-    assert info.envs == {
-        "E2E_PLAIN": SandboxEnvValue(value="plain-value", secret=False),
-        "E2E_SECRET": SandboxEnvValue(value="secret-value", secret=True),
-        "E2E_DEFAULT": SandboxEnvValue(value="default-value", secret=True),
-    }
-
-
 @pytest.mark.asyncio
 async def test_gets_sandbox_by_name_record_and_url(
     client: SandboxClient | AsyncSandboxClient, shared: _Shared