sandboxes #79

New issue

Closed

opened 2026-10-29 14:19:19 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-29 14:19:19 +00:00

Owner

Originally created by @LSX-s-Software on GitHub (Sep 20, 2026).
Original GitHub issue: https://github.com/kvcache-ai/AgentENV/issues/305

Originally assigned to: @LSX-s-Software on GitHub.

Affected component

API server / proxy

AgentENV version

Commit: 531a002b28f71df0df881237b3784fa326292f48
Local modifications during reproduction: none
E2B TypeScript SDK: 2.51.0
Node.js: v24.14.0

Host environment

OS: Ubuntu 24.04.4 LTS
Kernel: Linux 6.8.0-138-generic
Architecture: x86_64
Virtualization: systemd-detect-virt reports none; /dev/kvm is available
ublk: available; the E2E template builds and CLI/Python sandbox operations completed successfully
Runtime mode: single-node, default configuration, isolated test state and copied runtime dependencies

Operation and configuration

SUITE_FILTER='09*' make test-e2e

The reproduction used isolated AENV_HOME_PATH, AENV_RUNTIME_PATH, and AENV_DEPS_PATH, with matching AENV_TEST_STATE_DIR and AENV_TEST_DEPS_PATH.

scripts/tests/e2e/suites/09_e2b_compat.sh installs e2b@latest on every run. At reproduction time, this resolved to 2.51.0.

Steps to reproduce

On a host configured for AgentENV VM E2E tests, run the compatibility suite using the command above.
The TypeScript test builds a fresh template and creates a managed volume successfully.
It calls Sandbox.create(templateName, { secure: true, timeoutMs: 90000, volumeMounts: { [mountPath]: volume }, ...connOpts }).
Observe SandboxError: 405: Method Not Allowed and a failed TypeScript SDK compatibility check.

A smaller reproduction against a running test server is Sandbox.create(templateName, connOpts) using e2b@2.51.0; a volume is not required to trigger the routing failure.

Expected behavior

The E2B SDK compatibility suite passes, including sandbox creation and subsequent lifecycle operations using the installed SDK.

Actual behavior

The SDK sends POST /v2/sandboxes, but AgentENV registers only GET /v2/sandboxes. Sandbox creation is still registered at POST /sandboxes. The request is rejected with HTTP 405 before reaching sandbox creation or volume-mount handling.

The focused suite reproduced the reported result: seven checks passed, with only the TypeScript SDK check failing (1/8 tests failed). The installed Python SDK was 2.35.0; its compatibility check passed.

Logs and diagnostics

[e2b-ts-sdk] building template e2b-ts-sdk-1789892247214 from ghcr.io/linuxserver/baseimage-ubuntu:noble
[e2b-ts-sdk] template ready: templateId=01a0bde4-3f37-7551-8c95-50f4b3883b63 buildId=01a0bde4-3f37-7551-8c95-50f4b3883b63
[e2b-ts-sdk] volume ready: volumeId=vol_01a0bde44cfa71829b3a91415ad3670a name=e2b-ts-volume-1789892247214
[e2b-ts-sdk] creating sandbox with a volume through the SDK
[e2b-ts-sdk] failed: SandboxError: 405: Method Not Allowed
  [FAIL] e2b TypeScript SDK compatibility
         expected: exit 0
         got:      non-zero
[09_e2b] 1/8 tests failed.

Direct authenticated HTTP probes using an intentionally nonexistent template confirmed the routing difference:

POST /v2/sandboxes -> 405; Allow: GET,HEAD
POST /sandboxes    -> 400; {"code":400,"message":"template diagnostic-missing-template not found"}

Source references at the reproduced commit:

Reproduction frequency

Always with the tested SDK/server combination.

Regression information

First confirmed failing combination: the AgentENV commit above with e2b@2.51.0.
The exact SDK release that introduced the endpoint change has not been bisected.
Installing e2b@latest allows the compatibility target to change without a repository change.

Additional context

The installed SDK also uses POST /v2/sandboxes/{sandboxID}/connect, while AgentENV currently exposes the unversioned connect endpoint. This additional gap was identified by source inspection; the failing E2E run stops at creation before reaching connect.

Compatibility work should review both v2 endpoints and their request/default semantics, including secure sandbox behavior and timeout lifecycle defaults, rather than treating this solely as a path alias. Pinning a previously validated SDK can stabilize a baseline but does not establish compatibility with the latest SDK.

Related broader tracking issue: #5.

Pre-submission checklist

I searched existing open and closed issues and did not find a duplicate.
I provided a minimal reproduction or explained why one cannot be provided.
I removed credentials, tokens, private image references, and other sensitive information.
This is not a security vulnerability.

Originally created by @LSX-s-Software on GitHub (Sep 20, 2026). Original GitHub issue: https://github.com/kvcache-ai/AgentENV/issues/305 Originally assigned to: @LSX-s-Software on GitHub. ### Affected component API server / proxy ### AgentENV version - Commit: `531a002b28f71df0df881237b3784fa326292f48` - Local modifications during reproduction: none - E2B TypeScript SDK: `2.51.0` - Node.js: `v24.14.0` ### Host environment - OS: Ubuntu 24.04.4 LTS - Kernel: Linux 6.8.0-138-generic - Architecture: x86_64 - Virtualization: `systemd-detect-virt` reports `none`; `/dev/kvm` is available - ublk: available; the E2E template builds and CLI/Python sandbox operations completed successfully - Runtime mode: single-node, default configuration, isolated test state and copied runtime dependencies ### Operation and configuration ```sh SUITE_FILTER='09*' make test-e2e ``` The reproduction used isolated `AENV_HOME_PATH`, `AENV_RUNTIME_PATH`, and `AENV_DEPS_PATH`, with matching `AENV_TEST_STATE_DIR` and `AENV_TEST_DEPS_PATH`. `scripts/tests/e2e/suites/09_e2b_compat.sh` installs `e2b@latest` on every run. At reproduction time, this resolved to `2.51.0`. ### Steps to reproduce 1. On a host configured for AgentENV VM E2E tests, run the compatibility suite using the command above. 2. The TypeScript test builds a fresh template and creates a managed volume successfully. 3. It calls `Sandbox.create(templateName, { secure: true, timeoutMs: 90000, volumeMounts: { [mountPath]: volume }, ...connOpts })`. 4. Observe `SandboxError: 405: Method Not Allowed` and a failed TypeScript SDK compatibility check. A smaller reproduction against a running test server is `Sandbox.create(templateName, connOpts)` using `e2b@2.51.0`; a volume is not required to trigger the routing failure. ### Expected behavior The E2B SDK compatibility suite passes, including sandbox creation and subsequent lifecycle operations using the installed SDK. ### Actual behavior The SDK sends `POST /v2/sandboxes`, but AgentENV registers only `GET /v2/sandboxes`. Sandbox creation is still registered at `POST /sandboxes`. The request is rejected with HTTP 405 before reaching sandbox creation or volume-mount handling. The focused suite reproduced the reported result: seven checks passed, with only the TypeScript SDK check failing (`1/8 tests failed`). The installed Python SDK was `2.35.0`; its compatibility check passed. ### Logs and diagnostics ```text [e2b-ts-sdk] building template e2b-ts-sdk-1789892247214 from ghcr.io/linuxserver/baseimage-ubuntu:noble [e2b-ts-sdk] template ready: templateId=01a0bde4-3f37-7551-8c95-50f4b3883b63 buildId=01a0bde4-3f37-7551-8c95-50f4b3883b63 [e2b-ts-sdk] volume ready: volumeId=vol_01a0bde44cfa71829b3a91415ad3670a name=e2b-ts-volume-1789892247214 [e2b-ts-sdk] creating sandbox with a volume through the SDK [e2b-ts-sdk] failed: SandboxError: 405: Method Not Allowed [FAIL] e2b TypeScript SDK compatibility expected: exit 0 got: non-zero [09_e2b] 1/8 tests failed. ``` Direct authenticated HTTP probes using an intentionally nonexistent template confirmed the routing difference: ```text POST /v2/sandboxes -> 405; Allow: GET,HEAD POST /sandboxes -> 400; {"code":400,"message":"template diagnostic-missing-template not found"} ``` Source references at the reproduced commit: - [Unpinned SDK installation](https://github.com/kvcache-ai/AgentENV/blob/531a002b28f71df0df881237b3784fa326292f48/scripts/tests/e2e/suites/09_e2b_compat.sh#L149-L159) - [SDK sandbox creation in the test](https://github.com/kvcache-ai/AgentENV/blob/531a002b28f71df0df881237b3784fa326292f48/scripts/tests/e2e/e2b_ts_sdk_compat.ts#L131-L143) - [GET-only v2 route](https://github.com/kvcache-ai/AgentENV/blob/531a002b28f71df0df881237b3784fa326292f48/src/api/generated/src/server/mod.rs#L120) - [OpenAPI v2 sandbox path](https://github.com/kvcache-ai/AgentENV/blob/531a002b28f71df0df881237b3784fa326292f48/src/api/openapi.yml#L1611-L1680) ### Reproduction frequency Always with the tested SDK/server combination. ### Regression information - First confirmed failing combination: the AgentENV commit above with `e2b@2.51.0`. - The exact SDK release that introduced the endpoint change has not been bisected. - Installing `e2b@latest` allows the compatibility target to change without a repository change. ### Additional context The installed SDK also uses `POST /v2/sandboxes/{sandboxID}/connect`, while AgentENV currently exposes the unversioned connect endpoint. This additional gap was identified by source inspection; the failing E2E run stops at creation before reaching connect. Compatibility work should review both v2 endpoints and their request/default semantics, including secure sandbox behavior and timeout lifecycle defaults, rather than treating this solely as a path alias. Pinning a previously validated SDK can stabilize a baseline but does not establish compatibility with the latest SDK. Related broader tracking issue: #5. ### Pre-submission checklist - [x] I searched existing open and closed issues and did not find a duplicate. - [x] I provided a minimal reproduction or explained why one cannot be provided. - [x] I removed credentials, tokens, private image references, and other sensitive information. - [x] This is not a security vulnerability.

bsakaguchi

2026-10-29 14:19:19 +00:00