From 9770f9e50ee244d512761e4e842dbeb6e0ed4bf4 Mon Sep 17 00:00:00 2001 From: Lily Shen <115414357+lilyshen0722@users.noreply.github.com> Date: Tue, 27 Oct 2026 22:45:45 -0700 Subject: [PATCH] fix(legal): name E2B as the code-sandbox processor on /privacy Hosted agents' commonly_run_code runs in an E2B sandbox (turnSandboxService: no internet, empty env, closed at turn end), and the code and its output pass through E2B. "Who processes your data" listed the model providers but not the sandbox. Adds the line and a test pinning both DeepSeek and E2B. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01MDs9DS3E4dzoHKdxtgQqyz --- frontend/src/v2/__tests__/V2LegalPage.test.tsx | 6 ++++++ frontend/src/v2/legal/V2LegalPage.tsx | 1 + 2 files changed, 7 insertions(+) diff --git a/frontend/src/v2/__tests__/V2LegalPage.test.tsx b/frontend/src/v2/__tests__/V2LegalPage.test.tsx index 95529c74c6..4f87323fd3 100644 --- a/frontend/src/v2/__tests__/V2LegalPage.test.tsx +++ b/frontend/src/v2/__tests__/V2LegalPage.test.tsx @@ -11,6 +11,12 @@ describe('public legal pages (TASK-530)', () => { expect(screen.queryByText(/Draft for review/)).not.toBeInTheDocument(); }); + it('names the providers that process hosted-agent data', () => { + render(); + expect(screen.getByText(/DeepSeek is the default model/)).toBeInTheDocument(); + expect(screen.getByText(/^Code sandbox: E2B\./)).toBeInTheDocument(); + }); + it('links the addresses by mailto and links home', () => { render(); expect(screen.getByRole('link', { name: 'privacy@commonly.me' })).toHaveAttribute('href', 'mailto:privacy@commonly.me'); diff --git a/frontend/src/v2/legal/V2LegalPage.tsx b/frontend/src/v2/legal/V2LegalPage.tsx index 3aa8f6752d..473be261f4 100644 --- a/frontend/src/v2/legal/V2LegalPage.tsx +++ b/frontend/src/v2/legal/V2LegalPage.tsx @@ -53,6 +53,7 @@ const PRIVACY_SECTIONS: LegalSection[] = [ 'Error monitoring: Sentry. Personal data is not sent by default.', 'AI models for hosted agents: DeepSeek is the default model. OpenRouter serves some hosted routes, including free community models and two paid models. Cloudflare Workers AI is the fallback.', 'When you talk to a hosted agent, your messages and the agent\'s context are sent to that model provider to generate the reply.', + 'Code sandbox: E2B. When a hosted agent runs code, the code and its output pass through an E2B sandbox with no internet access, which is deleted when the turn ends.', 'Agents you run on your own machine use your own model provider. We do not process those model calls.', ], },