[scott-cw]

What and why

Adds a built-in coreweave sandbox provider so AgentEnv can run agents and environments on CoreWeave Sandboxes. Install it with agentenv-framework[coreweave] and select it through the existing sandbox configuration. One provider accepts either CoreWeave or W&B credentials through env: or secret: references.

Closes #301.

• Container mode: agents, standalone MCP servers and explicit container deployments run their requested image directly, preserving its entrypoint and environment. Published images use the artifact's recorded digest, including shipped-agent images with a fallback build context.
• VM mode: a Docker-capable CoreWeave sandbox runs AgentEnv's Compose gateways and explicit VM workflows. It supports registry images, image tarballs and build contexts. Docker storage uses loop-mounted ext4 by default, with optional tmpfs; a host Dockerfile supplies the tools needed when startup cannot reach package mirrors.

Both modes support command execution, file transfers, public HTTPS endpoints, egress policy, reconnect and idempotent teardown. The Sandbox API keeps a deleted sandbox's record, so reconnect treats a sandbox that is terminating, completed, failed or terminated as not found. The requested timeout sets the sandbox's hard lifetime. Failed or cancelled creation attempts reclaim the sandbox; cancellation waits for cleanup rather than leaving it to a background callback. Reconnect identifies the mode from the API's echoed container specification.

The extra requires cwsandbox>=1.19.6,<2, locked to 1.19.6. That release raises an error when an exec stream ends without an exit status. The provider propagates that error rather than reporting success or automatically retrying the command.

Behavior and limits for reviewers:

• Native containers require registry images. Tar-only, build-context-only and local-only images are refused, as are images requiring credentials held by AgentEnv's image store. VM image-loading and build workflows remain available. An agent requesting enable_docker=True must run on an explicit VM-mode sandbox.
• HTTPS endpoints use OPEN authentication and a 900-second request timeout. Hostname egress grants allow HTTPS on port 443; CIDR grants support other destinations. Applied policy is recorded as unknown when the platform rules cannot be represented.
• Native environment variables, including an agent's model API key, are stored in the sandbox specification. Native file writes require sh, mkdir, head and tar, and are limited to about 256 MiB. File payloads are fetched by the client before upload; VM transfers use permitted signed downloads or exec stdin.
• Native disk_size_gb is logged as ignored. VM Docker storage rounds upward to whole GB with a 20 GB minimum. Cancellation cleanup may take about 30 seconds plus deletion round trips.
• Native inter-sandbox private networking, GPU allocation, CoreWeave filesystem snapshots, pause/resume and arm64 support are not implemented. AgentEnv's existing application-level snapshot operations are distinct from CoreWeave filesystem snapshots.

Site documentation should cover installation and configuration, both sandbox modes, authentication, image requirements, endpoint exposure, egress, file-transfer limits and the prepared Docker host image. Provider maintenance and host-image publishing ownership remain to be settled before submission.

How it was tested

All checks below ran on the final branch (based on 3796d4c) with SDK 1.19.6.

• 116 CoreWeave unit tests passed, covering both modes, deployment paths, digest-pinned images, startup requests, reconnect, ended sandboxes, policy and cleanup:

  .venv/bin/python -m pytest -o log_cli=false -q \
    tst/unit/providers/sandbox_providers/coreweave_sandbox_provider_test.py \
    tst/unit/providers/sandbox_providers/coreweave_sandbox_test.py \
    tst/unit/providers/sandbox_providers/coreweave_deploy_paths_test.py

• 1,433 passed, 14 skipped across the broader image and deployment tests.

Broader test command

.venv/bin/python -m pytest -o log_cli=false -q \
  tst/unit/providers/sandbox_providers/coreweave_sandbox_provider_test.py \
  tst/unit/providers/sandbox_providers/coreweave_sandbox_test.py \
  tst/unit/providers/sandbox_providers/coreweave_deploy_paths_test.py \
  tst/unit/providers/sandbox_providers/vm_sandbox_test.py \
  tst/unit/bundle \
  tst/unit/env/published_images_test.py \
  tst/unit/env/bootstrap_test.py \
  tst/unit/providers/sandbox_providers/host_images_test.py \
  tst/unit/providers/sandbox_providers/local_sandbox_test.py

• make unit-test: 11,969 passed, 66 skipped, 1 failed. The failure is tst/unit/agents/hermes/test_hermes_bridge.py::test_the_event_pipe_is_not_left_open_in_the_server, which reads /proc/self/fd and fails on macOS regardless of this change.

• uv lock --check, make lint and plugin API compatibility passed:

  .venv/bin/python .github/scripts/check_plugin_api.py \
    --base 3796d4c --title 'feat(sandbox): add the CoreWeave provider'

• All 7 CoreWeave live smoke tests passed through the real API: VM nested Docker, public ports, uploads and reconnect; allowlisted VM and native-container egress (an allowed host reachable, others blocked, policy read back on reconnect); native image startup with its own entrypoint, env and file writes; file writes as a non-root image user (nginx-unprivileged), with a write the user cannot make failing; and the container, VM and VM Docker architectures and VM runtime class matching what the sandbox reports. The first run found that a deleted sandbox reconnected instead of raising SandboxNotFoundError; the fix and its unit tests are in this branch.

  .venv/bin/python -m pytest -o addopts= -n 0 -v -rs \
    tst/integration/providers/sandbox_providers/coreweave_sandbox_smoke_test.py

• agent-env run hello --sandbox coreweave and agent-env run echo-mcp --sandbox coreweave passed, both recorded on CoreWeave sandboxes and torn down.

• CoreWeave gateway and task-step integration cases (-k coreweave over tst/integration/env/gateway/gateway_test.py and tst/integration/env/task_step/task_steps_test.py, no model endpoint): 12 passed, 67 skipped with declared capability reasons (64 mcp_server_sources, 2 default_a2a_agent, 1 model_endpoint_configured). test_gateway_with_multi_mcp_server[coreweave] failed once with Internal error from Core from the Sandbox API during an image upload, and passed on rerun.

Not run: the 64 gateway clock cases that build MCP servers from AGENT_ENV_TEST_MCP_SERVERS_DIR, and the cases needing a registered default agent or a model endpoint.

Both Claude and Codex used to create

Confidence Score: 5/5

The PR appears safe to merge, with the outstanding late-create cleanup finding addressed.

Summary

Adds CoreWeave sandboxes in two modes:

• CoreWeave runs workloads directly in containers or inside Docker-host VMs.
• CoreWeave sandboxes support commands, file transfers, endpoints, and reconnects.
• AgentEnv can select CoreWeave as a built-in sandbox provider.

The latest change completes late-start cleanup when the create response is lost. No new actionable issues were found.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[CoreWeave provider] --> B[Native container]
  A --> C[Docker-capable VM]
  B --> D[Requested image]
  C --> E[Gateway and Docker workloads]
  A --> F[Failed or cancelled create]
  F --> G[Delete by ID or unique tag]

Loading

_{Reviews (5) · Last reviewed commit: "fix(sandbox): find by its tag the sandbo..." · Reviewed by Greptile}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/​cwsandbox@​1.19.6

View full report