Sandbox Platform

Use the authenticated Sandbox controller for remote execution. Treat agent instructions as workflow guidance; controller policy, AEGIS scheduling, and worker enforcement decide what can run.

Run the lifecycle

1. Require SANDBOX_URL and obtain SANDBOX_TOKEN from the caller's secret mechanism. Never print the token.
2. Call sandbox_health or run sandbox doctor. Stop and report connection or authentication failures.
3. Inspect existing sandboxes when reuse is allowed. Otherwise choose a base sandbox or a built-in coding-agent profile.
4. Classify repository trust, generated-code execution, secret need, data sensitivity, network need, resources, and TTL before creation.
5. Create with isolation: auto unless the caller explicitly requires microvm. Do not weaken a server isolation decision to obtain capacity.
6. Wait for creation to finish. Execute commands as argv arrays, not interpolated shell strings.
7. Inspect operation state, command exit code, stderr, and truncated. Recover only from the observed failure.
8. Delete disposable sandboxes and wait for cleanup unless the caller explicitly asks to retain one.

Choose an interface

Prefer MCP when tools are connected. Use the CLI for operator terminals, scripts, or when MCP is unavailable. Keep behavior identical across both interfaces.