# Coding agents

Sandbox profiles encode sane resource, network, sensitivity, and risk signals for coding agents. They do not embed API keys.

## Included profiles

| Profile | Executable | Default image strategy |
|---|---|---|
| Codex | `codex` | Local pinned image builder |
| Claude Code | `claude` | Local pinned image builder |
| OpenCode | `opencode` | Local pinned image builder |
| Pi | `pi` | Local pinned image builder |
| Aider | `aider` | Official `paulgauthier/aider` image |
| Goose | `goose` | Official `ghcr.io/block/goose` image |
| CommandCode | `commandcode` | Organization-provided local image |

Image versions for npm-based agents live in `images/agents/versions.env` and should be updated by a reviewed dependency PR.

## Build local images

```sh
./scripts/build-agent-image.sh codex
./scripts/build-agent-image.sh claude
./scripts/build-agent-image.sh opencode
./scripts/build-agent-image.sh pi
```

The common image uses Node 24, installs Git/OpenSSH/ripgrep, installs the exact agent version under `/opt/agent`, and runs as UID 10001. Pin the base image digest and publish signed images to an enterprise registry before production.

## Repositories

The v0.1 API does not yet have a first-class repository checkout object. Build a base image with repository access tooling, then use argv-safe `git clone` through `sandbox exec`, or implement a runtime driver that materializes a reviewed source snapshot. Avoid forwarding a developer's long-lived SSH key.

Preferred patterns:

- GitHub/GitLab App token scoped to one repository and one operation;
- signed source archive generated by a trusted fetch service;
- short-lived SSH certificate issued to the sandbox workload identity;
- read-only checkout plus a separate reviewed patch/export channel.

## Credentials

Agent providers need credentials, but the base API intentionally has no plaintext secret field. An enterprise runtime driver should exchange an opaque secret reference for a short-lived credential inside the isolation boundary, avoid writing it to the image or control database, and revoke it on deletion.

## Non-interactive behavior

The current execution path captures stdout/stderr and does not allocate a PTY. Use agent non-interactive modes where available. Interactive terminal streaming, resumable sessions, and session recording are roadmap work.