feat: implement agent sandbox configuration

.github/workflows/ambient-sdk-drift-check.yml

@@ -41,7 +41,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
-          go-version-file: components/ambient-sdk/generator/go.mod
+          go-version-file: components/ambient-sdk/go-sdk/go.mod
           cache-dependency-path: components/ambient-sdk/generator/go.sum
 
       - name: Regenerate SDK from OpenAPI spec

Makefile

@@ -16,7 +16,7 @@
 .DEFAULT_GOAL := help
 
 # Configuration
-CONTAINER_ENGINE ?= podman
+CONTAINER_ENGINE ?= $(shell command -v podman >/dev/null 2>&1 && echo podman || echo docker)
 
 # Auto-detect host architecture for native builds
 # Override with PLATFORM=linux/amd64 or PLATFORM=linux/arm64 if needed
@@ -195,6 +195,7 @@ build-ambient-ui: ## Build ambient-ui image
 	@cd components && $(CONTAINER_ENGINE) build $(PLATFORM_FLAG) $(BUILD_FLAGS) \
 		-f ambient-ui/Dockerfile \
 		--build-arg GIT_COMMIT=$(shell git rev-parse HEAD) \
+		--build-arg OPENSHELL_USE_GATEWAY=$(OPENSHELL_USE_GATEWAY) \
 		-t $(AMBIENT_UI_IMAGE) .
 	@echo "$(COLOR_GREEN)✓$(COLOR_RESET) Ambient UI built: $(AMBIENT_UI_IMAGE)"
 
@@ -1107,6 +1108,7 @@ kind-reload-ambient-ui: check-kind check-kubectl check-local-context ## Rebuild
 	@cd components && $(CONTAINER_ENGINE) build $(PLATFORM_FLAG) \
 		-f ambient-ui/Dockerfile \
 		--build-arg GIT_COMMIT=$(shell git rev-parse HEAD) \
+		--build-arg OPENSHELL_USE_GATEWAY=$(OPENSHELL_USE_GATEWAY) \
 		-t $(AMBIENT_UI_IMAGE) . $(QUIET_REDIRECT)
 	$(call kind-reload-component,$(AMBIENT_UI_IMAGE),ambient-ui,Ambient UI,ambient-ui)
 
@@ -1115,15 +1117,20 @@ kind-reload-ambient-control-plane: check-kind check-kubectl check-local-context
 	@$(CONTAINER_ENGINE) build $(PLATFORM_FLAG) $(BUILD_FLAGS) \
 		-f components/ambient-control-plane/Dockerfile \
 		--build-arg GIT_COMMIT=$(shell git rev-parse HEAD) \
-		-t $(CONTROL_PLANE_IMAGE) components $(QUIET_REDIRECT)
+		-t $(CONTROL_PLANE_IMAGE) components $(QUIET_REDIRECT) || \
+		{ echo "$(COLOR_RED)✗$(COLOR_RESET) Build failed. Run without QUIET=1 for full output."; exit 1; }
 	$(call kind-reload-component,$(CONTROL_PLANE_IMAGE),ambient-control-plane,Ambient control plane,ambient-control-plane)
 
 kind-reload-ambient-api-server: check-kind check-kubectl check-local-context ## Rebuild and reload ambient-api-server only (kind)
 	@echo "$(COLOR_BLUE)▶$(COLOR_RESET) Rebuilding ambient-api-server..."
 	@cd components/ambient-api-server && $(CONTAINER_ENGINE) build $(PLATFORM_FLAG) $(BUILD_FLAGS) \
 		--build-arg GIT_COMMIT=$(shell git rev-parse HEAD) \
-		-t $(API_SERVER_IMAGE) . $(QUIET_REDIRECT)
+		-t $(API_SERVER_IMAGE) . $(QUIET_REDIRECT) || \
+		{ echo "$(COLOR_RED)✗$(COLOR_RESET) Build failed. Run without QUIET=1 for full output."; exit 1; }
 	$(call kind-reload-component,$(API_SERVER_IMAGE),ambient-api-server,Ambient API server,api-server)
+	@_IMG=$$(kubectl get deployment ambient-api-server -n $(NAMESPACE) -o jsonpath='{.spec.template.spec.containers[0].image}') && \
+		kubectl set image deployment/ambient-api-server -n $(NAMESPACE) migration=$$_IMG $(QUIET_REDIRECT) && \
+		echo "$(COLOR_GREEN)✓$(COLOR_RESET) Migration init container updated to $$_IMG"
 
 kind-sso-toggle: check-kubectl ## Toggle SSO auth on/off in Kind (affects both frontend and backend)
 	@UNLEASH_ADMIN_TOKEN=$$(kubectl get secret unleash-credentials -n $(NAMESPACE) -o jsonpath='{.data.admin-api-token}' | base64 -d); \

components/ambient-api-server/cmd/ambient-api-server/main.go

@@ -18,8 +18,10 @@ import (
 	_ "github.com/ambient-code/platform/components/ambient-api-server/plugins/agents"
 	_ "github.com/ambient-code/platform/components/ambient-api-server/plugins/credentials"
 	_ "github.com/ambient-code/platform/components/ambient-api-server/plugins/inbox"
+	_ "github.com/ambient-code/platform/components/ambient-api-server/plugins/policies"
 	_ "github.com/ambient-code/platform/components/ambient-api-server/plugins/projectSettings"
 	_ "github.com/ambient-code/platform/components/ambient-api-server/plugins/projects"
+	_ "github.com/ambient-code/platform/components/ambient-api-server/plugins/providers"
 	_ "github.com/ambient-code/platform/components/ambient-api-server/plugins/proxy"
 	_ "github.com/ambient-code/platform/components/ambient-api-server/plugins/rbac"
 	_ "github.com/ambient-code/platform/components/ambient-api-server/plugins/roleBindings"

components/ambient-api-server/openapi/openapi.agents.yaml

@@ -453,6 +453,29 @@ components:
               type: string
             environment_variables:
               type: string
+            entrypoint:
+              type: string
+              description: CLI binary to launch inside the sandbox (e.g., claude, opencode, bash). Defaults to claude.
+            providers:
+              type: array
+              items:
+                type: string
+              description: Names of providers this agent requires, referencing provider declarations in the tenant namespace.
+            payloads:
+              type: array
+              items:
+                $ref: '#/components/schemas/Payload'
+              description: Content to upload into the sandbox filesystem before the entrypoint launches.
+            environment:
+              type: object
+              additionalProperties:
+                type: string
+              description: Environment variables injected into the sandbox at creation time.
+            sandbox_template:
+              $ref: '#/components/schemas/SandboxTemplate'
+            sandbox_policy:
+              type: string
+              description: Name of a policy declaration in the tenant namespace. When omitted, the platform default policy applies.
             current_session_id:
               type: string
               readOnly: true
@@ -498,10 +521,90 @@ components:
         llm_max_tokens:
           type: integer
           format: int32
+        entrypoint:
+          type: string
+        providers:
+          type: array
+          items:
+            type: string
+        payloads:
+          type: array
+          items:
+            $ref: '#/components/schemas/Payload'
+        environment:
+          type: object
+          additionalProperties:
+            type: string
+        sandbox_template:
+          $ref: '#/components/schemas/SandboxTemplate'
+        sandbox_policy:
+          type: string
         labels:
           type: string
         annotations:
           type: string
+    Payload:
+      type: object
+      required:
+        - sandbox_path
+      properties:
+        sandbox_path:
+          type: string
+          description: Absolute path inside the sandbox where the content is delivered.
+        content:
+          type: string
+          description: Inline string content to place at the sandbox path.
+        repo_url:
+          type: string
+          description: Git repository URL to clone into the sandbox path.
+        ref:
+          type: string
+          description: Git ref to check out (branch, tag, or commit SHA). Only valid with repo_url.
+    SandboxTemplate:
+      type: object
+      properties:
+        image:
+          type: string
+          description: OCI container image reference for the sandbox.
+        resources:
+          $ref: '#/components/schemas/ResourceRequirements'
+        gpu:
+          $ref: '#/components/schemas/GpuRequirements'
+        runtime_class_name:
+          type: string
+          description: Kubernetes RuntimeClassName for the sandbox pod.
+        driver_config:
+          type: object
+          additionalProperties: true
+          description: OpenShell driver-specific opaque configuration (JSON).
+        labels:
+          type: object
+          additionalProperties:
+            type: string
+          description: Labels applied to the sandbox compute resources.
+        annotations:
+          type: object
+          additionalProperties:
+            type: string
+          description: Annotations applied to the sandbox compute resources.
+        log_level:
+          type: string
+          description: Sandbox supervisor log verbosity (debug, info, warn, error).
+    ResourceRequirements:
+      type: object
+      properties:
+        cpu:
+          type: string
+          description: CPU request/limit in Kubernetes quantity format (e.g., "2", "500m").
+        memory:
+          type: string
+          description: Memory request/limit in Kubernetes quantity format (e.g., "4Gi", "256Mi").
+    GpuRequirements:
+      type: object
+      properties:
+        count:
+          type: integer
+          description: Number of GPUs to allocate. Default 0.
     AgentSessionList:
       allOf:
         - $ref: 'openapi.yaml#/components/schemas/List'