mirror of
https://github.com/kvcache-ai/AgentENV.git
synced 2026-11-05 01:17:36 +00:00
[GH-ISSUE #443] Sandbox endpoints return 404 instead of 400 for malformed sandbox IDs #111
Labels
No labels
bug
documentation
enhancement
enhancement
pull-request
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
kvcache-ai/AgentENV#111
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @murtuzamvista on GitHub (Oct 27, 2026).
Original GitHub issue: https://github.com/kvcache-ai/AgentENV/issues/443
Affected component
API server / proxy
AgentENV version
424b852d96Follow-up to #5 (E2B API Compatibility Matrix).
Problem
The matrix notes that E2B returns
400for an invalid sandbox ID. AgentENV currently returns404withsandbox <id> not foundfor a malformed ID, the same as for a well-formed ID that doesn't exist.Reproduction
Tested on a local server (Ubuntu 24.04 arm64, installed with
install.sh):The same 404 comes back from
POST /sandboxes/not-a-valid-id/{pause,fork,connect,timeout}(the last two with a valid body).For comparison, a well-formed UUID that doesn't exist:
Expected
400, with the same{code, message}body shape404(unchanged)Proposal
Validate the ID at the shared lookup point. If it doesn't parse as a UUID, return 400 with a clear message. Add tests for both cases.
Open question
Sandbox IDs here are UUIDv7, while E2B's own IDs have a different format. Is "doesn't parse as a UUID" the right definition of invalid, or would you prefer something else?
I'd like to work on this. Happy to wait for a view on the question above before opening a PR.
Host environment
uname -a): Linux lima-aenv 6.8.0-142-generic #142-Ubuntu SMP PREEMPT_DYNAMIC Wed Sep 2 14:30:29 UTC 2026 aarch64 aarch64 aarch64 GNU/Linuxmodprobe ublk_drvsucceeds, module shows in lsmod)Operation and configuration
Steps to reproduce
Install and start the server on a Linux host with
/dev/kvm(tested on Ubuntu 24.04 arm64; the behavior doesn't depend on the architecture as far as I can tell):Read the generated API key (redact it in anything you share):
Request a sandbox with a malformed ID. No sandbox needs to exist:
Actual:
{"code":404,"message":"sandbox not-a-valid-id not found"}/404Expected:
400Repeat with the other sandbox operations (same actual result,
404):Control case: a well-formed UUID that doesn't exist.
404is correct here:Actual:
{"code":404,"message":"sandbox 01a1771b-0000-7000-8000-000000000000 not found"}/404Expected behavior
A sandbox ID that isn't well-formed should be rejected as a bad request, not reported as a missing sandbox. The E2B API Compatibility Matrix in #5 notes that E2B returns
400for an invalid sandbox ID, and AgentENV aims to be compatible with E2B clients.GET /sandboxes/not-a-valid-id400404POST /sandboxes/not-a-valid-id/pause400404POST /sandboxes/not-a-valid-id/fork400404POST /sandboxes/not-a-valid-id/connect400404POST /sandboxes/not-a-valid-id/timeout400404GET /sandboxes/01a1771b-0000-7000-8000-000000000000(well-formed, nonexistent)404(unchanged)404The error body should keep the existing shape,
{"code": 400, "message": "..."}, with a message that says the ID is invalid (for example,invalid sandbox ID: not-a-valid-id), so clients can tell a malformed ID from a missing sandbox.Open question: sandbox IDs in AgentENV are UUIDv7, while E2B's own IDs have a different format. My proposal is to treat any path ID that doesn't parse as a UUID as invalid. Happy to adjust if you'd define it differently.
Actual behavior
Observed responses (same order as the requests above):
GET /sandboxes/not-a-valid-id{"code":404,"message":"sandbox not-a-valid-id not found"}POST /sandboxes/not-a-valid-id/pausePOST /sandboxes/not-a-valid-id/forkPOST /sandboxes/not-a-valid-id/connectPOST /sandboxes/not-a-valid-id/timeoutGET /sandboxes/01a1771b-0000-7000-8000-000000000000(well-formed, nonexistent){"code":404,"message":"sandbox 01a1771b-0000-7000-8000-000000000000 not found"}Expected: the five malformed-ID requests return
400, and only the last one returns404.Logs and diagnostics
Reproduction frequency
Always
Regression information
Not known to be a regression. I have only tested one build, the one installed by
install.sh(version/commit: ), and have no earlier build to compare against. The behavior may have always been this way.Additional context
curl. I didn't test whether any E2B SDK treats the 400 and 404 differently on the client side.POST /sandboxes/{id}/connectand/timeoutwith a body missingtimeoutreturn422. I believe E2B returns400for malformed request bodies, but I haven't verified that against the E2B spec. I can open a separate issue if that's useful.Pre-submission checklist
@yingdi-shan commented on GitHub (Oct 28, 2026):
Thanks for the detailed report.
We'd like to keep 404 here. From the client's side, a malformed ID and a well-formed ID that doesn't exist mean the same thing: there's no sandbox with that ID. 404 sandbox not found is accurate in both cases, and clients only need one error path.
Returning 400 would mean the API has to know what a valid ID looks like, so the UUID format becomes part of the public contract. That's an internal detail we'd rather not commit to, and we may want to change the ID scheme later. So we'll close this as intended behavior.
@murtuzamvista commented on GitHub (Oct 28, 2026):
Thanks, that makes sense: the ID format staying an internal detail is a good reason. Understood on keeping 404. I’ll look at other items instead.