Repository navigation
add sandboxes: computers agents ask for, kept while they are away - #189
Merged
Merged
Conversation
Sandboxes live in Personal Agent Proxy itself, as the vault does: a Sandboxes connection of the organization's and of each member's own, made the first time they could be used, where the organization has the experiment and the server a sandbox backend. The sandboxes are the collection, listed, made with a name, put to sleep, woken and deleted as records; the console, sandbox_exec, is the integration's one tool of its own, with stdin, cwd and a timeout, and files are read and written through it. A sandbox is one task's at a time (native/sandbox/lease.ts): taken by the first command a task runs in it, free again once the task is finished or left open, and a sub-task of the holder works on it too; another task's command is refused with the holder named. Its machine is the backend's (machines.ts): woken by its next command, put to sleep by the sweeper after 30 minutes without one, and every move of a row fenced on the state it leaves. Agents that may use sandboxes are told what they are and how to work in them; the web app lists them with their state, the task using each and when it was last used, and deletes one; the docs have a page. The catalog gains the sandbox integration, the schema the Sandbox table, and the experiment `sandboxes`.
hkonsti
force-pushed
the
hkonsti/sandboxes
branch
from
November 5, 2026 00:08
59d4fa3 to
f27bdbb
Compare
Whether the server has a sandbox backend was said twice, as SANDBOX_BACKEND and as the service's address; the address says it by itself now, dev the one value that is no address, for the development-only backend on this machine.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacked on #187, which it needs for
@proxy/backends.Sandboxes live in Personal Agent Proxy itself, as the vault does. Every organization and member gets a Sandboxes connection the first time they could use one: where the organization has the
sandboxesexperiment and the server a sandbox backend (SANDBOX_BACKEND). Three actions: see, use (make, wake, run commands; high risk) and delete; the member's own connection gives agents the first two by default, the organization's nothing until its owner turns it on.sandbox_exec, withcommand,stdin,cwdandtimeout(60 s unless given, at most 120); files are read and written through it. A sandbox asleep is woken by its next command.native/sandbox/lease.ts): the first command a task runs in a sandbox takes it; it stays that task's while the task is under way and is free again once it is finished or left open by the existing twenty-minute rule; a sub-task of the holder works on it too; another task's command is refused with the holder named, in words the agent can act on.machines.ts): every move of a row is fenced on the state it leaves, so two calls never both ask the backend. A sweeper puts sandboxes to sleep after 30 minutes without a command.Sandboxtable (migrationv043_add_sandboxes).NAMED_AFTER_ORGANIZATIONcarries the Sandboxes connections through a rename as it does the vaults.Checked end to end on a local stack against the internal service on agentOS (personalagentproxy/internal#26): a demo agent through the gate made a sandbox, ran git, wrote a file through stdin, slept and woke it by its next command, had a timeout keep partial output, saw a second task refused with the holder named, and was refused delete, which is off by default. Suites: api 1165, web 293, integrations, contracts, backends, map; docs build.
Not in this PR: sleep and wake from the web page (the human side has no record-command route yet), retention of free sandboxes, forking.
Open workspace in Conductor