Skip to main content
The goal: an agent that receives a bug report, writes a fix in a real checkout, runs the test suite, and delivers a diff — with evidence that the tests passed. Without a sandbox an agent can only describe a fix.

1. Turn the sandbox on

sandbox is not a boolean. It takes a mode:
🔴 toolTimeoutMs may not exceed half of sliceWallMs, and the server enforces it. A tool timeout longer than half a wake cannot be enforced — the wake ends first. With the 14-minute maximum slice, 7 minutes is the ceiling for a single command; the example above leaves headroom at 5.sliceWallMs bounds a wake, not the task. A build that needs 40 minutes spans four wakes and finishes; it does not need a 40-minute slice, and asking for one is refused.

2. What the sandbox toggle actually grants

Each product toggle maps to concrete tools the agent is offered: So sandbox: "auto" is what puts bash, read and edit on the table. An agent with sandbox: "none" cannot run a command no matter how the instructions are worded.
The Account Kit still narrows this. If the child project’s kit has the sandbox primitive off, tools.sandbox reads back as { requested: "auto", effective: "none" } and the agent is offered no bash. Check effective, never requested, when a run does not do what you expected.

3. Send it a bug

payload is for structured context — anything you would otherwise have to serialise into the prompt and re-parse. It reaches the agent alongside text.

4. Read what it did, tool call by tool call

The event log carries every command:
Tool arguments print as a digest by default. --show-args prints them in full and refuses to run in a pipe, because a full-argument dump of a sandbox run contains file contents and is not something to redirect into a log file by accident.

5. Collect the deliverable

Up to 20 deliverables per task, 25 MB each. A short diff comes back inline as content; a large one comes back as a download_url valid for an hour.
🔴 A final deliverable must carry an artifact or say why it does not. If the agent could not produce a fix, a final deliverable with no_artifact_reason: "the failing test does not reproduce on main" is a real answer. final: true with nothing at all is refused — otherwise “deliver” quietly becomes a status update, and a run that produced nothing looks like a run that succeeded.

6. Writing a deliverable yourself

The agent’s runtime normally writes these. If you are backfilling, migrating, or attaching the artifact a crashed turn produced, the write is two calls — the bytes never traverse the API process:
For a short artifact, skip the upload entirely and send text instead:
upload_url is null when the deployment has no storage sink configured. That is a deployment state, not an error — send the artifact as text instead. The same condition shows up on read as download_url: null with content carrying everything.

7. Keeping state between tasks

sandbox: "auto" tears the machine down. To keep a checkout warm across tasks, pin a workspace:
tools merges field by field on update, so this leaves storage alone.

Cost control for a sandbox agent

A sandbox agent is the most expensive shape this primitive has: long slices, many tool calls, and a build that can burn minutes without producing tokens.
  • Set max_task_micro_usd to what you would accept losing on one bug. It is checked before every model call against that task’s own spend — its root run plus every sub-agent it delegated to — and crossing it ends the task failed and non-retryable rather than parking it, because a per-task ceiling never resets.
  • On zai-org/GLM-5.2-FP8, set completion_window: "flex" when nobody is waiting: fewer, larger turns re-send the transcript fewer times, and flex input is priced at half the asap rate. On any other model asap is the only window served, and asking for another is refused rather than downgraded.
  • Watch the budget event on the stream — one per turn, before the call. Do not wire anything to alert_at: it is stored and nothing fires off it.
The agent cap parks; the per-task ceiling kills. When both would be crossed by the same call the cap wins, because parking is the recoverable answer — the period rolls and the task resumes. Nothing here reads budget.hard: both ceilings refuse unconditionally, so a hard: false sandbox agent is not softer than a hard: true one.