1. Turn the sandbox on
sandbox is not a boolean. It takes a mode:
2. What the sandbox toggle actually grants
Each product toggle maps to concrete tools the agent is offered:
So
sandbox: "auto" is what puts bash, read and edit on the table. An
agent with sandbox: "none" cannot run a command no matter how the instructions
are worded.
The Account Kit still narrows this. If the child project’s kit has the
sandbox primitive off, tools.sandbox reads back as
{ requested: "auto", effective: "none" } and the agent is offered no bash.
Check effective, never requested, when a run does not do what you expected.3. Send it a bug
payload is for structured context — anything you would otherwise have to
serialise into the prompt and re-parse. It reaches the agent alongside text.
4. Read what it did, tool call by tool call
The event log carries every command:--show-args prints them in
full and refuses to run in a pipe, because a full-argument dump of a sandbox run
contains file contents and is not something to redirect into a log file by
accident.
5. Collect the deliverable
content; a large one comes back as a download_url valid for an
hour.
🔴 A
final deliverable must carry an artifact or say why it does not. If
the agent could not produce a fix, a final deliverable with
no_artifact_reason: "the failing test does not reproduce on main" is a real
answer. final: true with nothing at all is refused — otherwise “deliver”
quietly becomes a status update, and a run that produced nothing looks like a
run that succeeded.6. Writing a deliverable yourself
The agent’s runtime normally writes these. If you are backfilling, migrating, or attaching the artifact a crashed turn produced, the write is two calls — the bytes never traverse the API process:text instead:
upload_url is null when the deployment has no storage sink configured. That
is a deployment state, not an error — send the artifact as text instead. The
same condition shows up on read as download_url: null with content carrying
everything.7. Keeping state between tasks
sandbox: "auto" tears the machine down. To keep a checkout warm across tasks,
pin a workspace:
tools merges field by field on update, so this leaves storage alone.
Cost control for a sandbox agent
A sandbox agent is the most expensive shape this primitive has: long slices, many tool calls, and a build that can burn minutes without producing tokens.- Set
max_task_micro_usdto what you would accept losing on one bug. It is checked before every model call against that task’s own spend — its root run plus every sub-agent it delegated to — and crossing it ends the taskfailedand non-retryable rather than parking it, because a per-task ceiling never resets. - On
zai-org/GLM-5.2-FP8, setcompletion_window: "flex"when nobody is waiting: fewer, larger turns re-send the transcript fewer times, andflexinput is priced at half theasaprate. On any other modelasapis the only window served, and asking for another is refused rather than downgraded. - Watch the
budgetevent on the stream — one per turn, before the call. Do not wire anything toalert_at: it is stored and nothing fires off it.