sandboxes

Env & secrets

Pass string env maps at create; optionally override per exec. No vault — the agent supplies tokens.

Create

{
  "agent_id": "coder",
  "guest_cid": 9101,
  "env": {
    "MY_TOKEN": "…",
    "GH_TOKEN": "…"
  }
}

Keys must be non-empty strings. FYSTASH_* keys are reserved and rejected.

Exec merge

{
  "argv": ["bash", "-lc", "echo \"$MY_TOKEN\""],
  "env": { "MY_TOKEN": "override-for-this-exec" }
}

Exec env merges over create-time env for that call only.

MCP

sandbox_create / sandbox_exec accept env_json (JSON object as a string).