[neekolas]

Run libxmtp coding agents, Nix builds, and a local backend inside one Docker Sandboxes VM, with a public clone of main and no host checkout or SSH-agent forwarding.

Add native v3 kits for Claude Code and Codex, a small host wrapper under dev/sbx, and per-session provider/model examples. Start checks existing kits and mounts, requires an empty Docker MCP catalog, repairs incomplete bootstrap, and connects Orca. Pause unlinks Orca before stopping so automatic reconnect cannot wake the VM. Provider keys use hidden host prompts and scoped proxy placeholders.

The README covers Morph's 1M context, Anthropic API keys and Claude subscription login, Codex API keys and ChatGPT OAuth, and native credential-isolation limits. Sandbox tests are manual under dev/sbx, outside CI discovery. Native Docker 0.50 retains Claude history volumes after destroy and reattaches them on same-name/kit recreation; the README and command output state this limit.

Validation:

• New v3 VM smoke: Rust check, backend image/stack, SDK send/query/decrypt (1 passed).
• dev/nix-shell 'just lint-config': passed.
• dev/nix-shell 'python3.11 -B dev/sbx/test_sandbox.py': 14 passed.
• Full just test dev: existing Android emulator fixture hit its ADB timeout; isolated rerun passed (8 tests). All other Python modules, the 206 release-tools tests, and the 4 Fly tests passed.
• Adversarial review: final pass at 0eb6c5c1fb found no remaining findings after mount/bootstrap fixes and the documented native-history decision.

Note

Add Docker Sandbox tooling to run libxmtp dev agents in a VM

• Adds a dev/sbx workflow for running Claude/Codex agents inside a Docker Sandbox VM: a sandbox CLI wrapper with start, pause, destroy, and key-register commands, plus a README
• Defines the libxmtp-claude VM environment in sbxenv.yaml (8 CPUs, 24 GB RAM, no host mounts or published ports) and a post-create setup hook that runs the guest bootstrap script
• Integrates Orca SSH target management via orca.mjs so the wrapper attaches the VM on start and removes the target on pause
• Provider API keys are validated and passed to sbx secret set-custom over stdin, never in command arguments; a smoke script checks the build and runs a backend message test
• Adds a Python test suite in test_sandbox.py that simulates sbx, Orca, and setup commands and covers lifecycle, key handling, and failure cases
• Behavioral Change: start refuses to run with foreign or multiple local VMs, a nonempty host MCP catalog, or SSH-agent forwarding enabled; same-name VMs with mismatched agent, mounts, or kits are not started or destroyed

^{Macroscope summarized 0eb6c5c.}

[macroscopeapp]

The generated Nix config uses the wrong include directive: nix.conf requires !include, so bootstrap writes a line that Nix cannot parse and later Nix commands fail. Please correct the directive.

Suggested change

	include_line="include $config_dir/libxmtp-sbx.conf"
	include_line="!include $config_dir/libxmtp-sbx.conf"

^{Posted via Macroscope — Code Quality}

[macroscopeapp]

Security: key only checks that a sandbox with this name exists; unlike start, it never calls check_vm. If that sandbox was replaced or reconfigured with unexpected kits or host mounts, following the documented key-registration command sends the credential to its proxy anyway, where the altered guest can use it. Please validate the existing VM before registering the key.

Suggested change

	register_key "$1" "$2"
	[[ $state != absent ]] || fail 'Run start before registering a key'
	check_vm
	register_key "$1" "$2"

^{Posted via Macroscope — Security}

[macroscopeapp]

Approvability

Verdict: Needs Human Approval

Macroscope's review found this PR requires human approval — This PR introduces a substantial Docker Sandbox and Orca workflow with host-managed provider credentials, VM lifecycle controls, and external integrations. Unresolved findings identify a broken Nix configuration directive and a credential-isolation gap when registering keys with an existing sandbox.

^{You can add or adjust custom eligibility rules. Learn more.}