Sandbox Agent

The sources place arbitrary-code agents inside sandboxes, show token authentication bound to 127.0.0.1 by default, and use relatively narrow CI permissions, providing a reasonable least-privilege baseline. However, no core permission-handling implementation is supplied, so per-action user confirmation cannot be established. The README explains that events leave through HTTP/SSE for caller-managed external storage and that persistence is out of scope, but it gives no complete classification, retention, or deletion policy. Credentials are passed through environment variables, and a command can extract and print personal API keys; the supplied files do not show redaction, encryption at rest, log filtering, or lifecycle controls. Dependencies are version-constrained and exercised in CI, but many constraints are broad and there is no supplied lockfile, security scan, or vulnerability-response evidence. Arbitrary command execution, agent installation, network streaming, and external persistence are disclosed external effects, yet fine-grained approval or effect previews are not demonstrated. Examples destroy sandboxes, but session recovery, undo, and persistence rollback are not provided. Repository, author, license, and contributor attribution are clear, while publisher identity remains unverified by the stated registry.

The README, Cargo metadata, SDK/CLI examples, and tests describe a generally coherent product, with core versions aligned around 0.4.2/0.4.x. Broad claims such as full feature coverage and operation in any sandbox are not supported by the supplied core implementation. Rust, Node, pnpm, external agent binaries, provider credentials, and platform prerequisites are partly documented, and agents may install lazily, but availability still depends on networks, third-party services, tokens, and provider tooling. Tests produce useful timeout, process-exit, startup-failure, and stdout/stderr diagnostics; these mostly demonstrate fixture diagnostics rather than the complete server and SDK error model.

Local development, remote server, embedded SDK, language-neutral HTTP clients, and multiple sandbox-provider scenarios are clearly distinguished, with concrete invocation paths, so audience and scenario coverage is thorough. The Out of Scope section and FAQ explicitly exclude external session persistence, direct LLM wrappers, Git management, and sandbox-provider APIs, earning full capability-boundary credit. Actions are triggered through explicit SDK, CLI, or HTTP requests and agent configuration, but the supplied files do not establish exact permission-prompt, retry, idempotency, or concurrent-event semantics. Environment fit covers several modes and providers and includes conditional integration tests; deductions reflect that some tests are skipped by default, require external credentials and tools, and do not substantiate the universal “any sandbox” claim.

The README is well organized around motivation, architecture, components, setup, FAQ, scope, and roadmap. It supplies practical npm, Bun, curl, CLI, embedded, and remote installation notes. Naming is consistent across packages, binaries, and Cargo metadata, but the product is still at 0.4.x and one compatibility feature is explicitly experimental, limiting stability evidence. Examples and FAQ coverage are extensive, and known exclusions are explicit. Apache-2.0 is consistent across metadata and a complete license file, justifying full license credit. Only the current version and 0.4.x channel are shown; no changelog, migration policy, or explicit compatibility policy is supplied. Cargo authorship, repository metadata, documentation, and Discord provide maintenance routes, but publisher identity is unknown and support ownership or commitments are not clearly allocated.

The unified HTTP/SSE API, TypeScript SDK, CLI, Inspector, universal event schema, and OpenAPI entry point yield directly usable outputs, with examples covering session creation, messages, and event streaming. A common adapter for otherwise distinct coding agents offers clear marginal value, but full feature parity and seamless swapping remain mostly asserted because adapter implementations and comparison evidence are absent. A static Rust binary and lazy installation may reduce deployment overhead, while agents, sandboxes, external storage, third-party APIs, and operations still impose costs; no benchmarks, resource figures, or cost model are provided, so cost-benefit support is adequate rather than thorough.

Many claims trace to concrete README examples, Cargo workspace metadata, CI steps, and provider health tests, providing reasonable static traceability. Missing core server, permission, and credential implementations prevent tracing several strong claims end to end. README, manifests, CI, and tests corroborate versions, components, and health-check behavior, but provider tests are conditional and no independent results or sources are supplied. Facts, roadmap items, experimental labels, and out-of-scope statements are generally separated, yet promotional claims such as “full feature coverage” and “any sandbox” are not clearly marked as inference or bounded by validation evidence.