Bailian Sandbox (bl sandbox)

Before running bl, read the shared bailian-protocol for consent, high-risk confirmation, version checks, authentication, and error handling. If it is missing, stop execution and prompt the user to install the full family with bl skill init.

Scope and setup

• Manage Sandbox instances and templates through Bailian's E2B-compatible REST control plane. No E2B SDK or E2B API key is required; authentication uses the Bailian API Key as an Authorization Bearer token.
• Resolve Base URL through the same CLI chain as Managed Agent: --base-url > DASHSCOPE_BASE_URL > login/profile base_url. Use an origin such as https://workspace.cn-beijing.maas.aliyuncs.com; the CLI strips URL paths/query/fragment and appends /api/v1/agentstudio/sandbox for lifecycle operations, or /api/v1/agentstudio/files for template file uploads. The saved API Key is reused. Profile capability fallback follows the shared protocol for both the key and Base URL.
• If no Base URL is configured, resolve the workspace from --workspace-id, then BAILIAN_WORKSPACE_ID, then configured workspace_id, and use https://{workspace_id}.cn-beijing.maas.aliyuncs.com/api/v1/agentstudio/sandbox. With a configured Base URL, the workspace flag is optional. The service currently supports cn-beijing and requires prior Sandbox SLR authorization.
• No agents.yaml or local IaC state is required. get / connect return instance connection information; neither opens an interactive shell or browser. For WebShell, CDP, or VNC, use that information with the runtime APIs described below. Do not invent bl sandbox exec, webshell, or browser subcommands.

Choose the operation