61

Source document

[2026-02-15 21:43] omega [bot]: ### What the 28 tests cover (6 files) - **Health & Metrics** — response shape, <2s response time - **Sessions** — create, get, resume (idempotent), destroy, 404, missing ID → 400, custom TTL - **Tools** — shellExec (echo, exit codes, timeout kill), writeFile+readFile round-trip, createDirs, listFiles root + recursive - **Security** — path traversal `../` blocked, symlink escape blocked, 401 without auth, health/metrics public - **Isolation** — two sessions have separate workspaces, git clone public repo, git init + commit - **Disk quota** — fill beyond 5MB → next tool call rejected (413) ### CI workflow (`.github/workflows/sandbox-tests.yml`) Triggers on push/PRs when sandbox files change. Two jobs: 1. **sandbox-direct** — Docker build + all 28 tests 2. **sandbox-e2e** — existing E2E test vs live web app (main only) ### Fixes made during testing - Added `ca-certificates` to Dockerfile (git HTTPS was broken without SSL certs) - Published `@tpmjs/of[email protected]` to npm - Timeout test uses `exec sleep` to prevent orphan processes - CI uses `MAX_CONCURRENT_SESSIONS=50` (test files run in parallel) [2026-02-16 19:01] ajaxdavis: not sure where this is going but agents in tpmjs can now have enabled sandboxes (files: Screenshot_2026-02-17_at_5.01.10_AM.png, Screenshot_2026-02-17_at_5.01.22_AM.png, Screenshot_2026-02-17_at_5.01.42_AM.png) [2026-02-16 19:02] ajaxdavis: will probably add claudecode to them and have them able to edit a codebase and push [2026-02-16 19:09] lisamegawatts: i was asking in unturf about something like this earlier, just agent + sandbox +webhooks for issues and pr [2026-02-16 19:09] ajaxdavis: yeah building a couple more things right now [2026-02-16 19:09] ajaxdavis: can you will just be able to call it via the api [2026-02-16 19:10] ajaxdavis: ``` TPMJS_KEY=xzy curl -POST https://tpmjs/agents/lisa/some-agent "can you fix the bug abc?" ``` [2026-02-16 19:10] ajaxdavis: and will work, and you can reuse the conversation or see it in the gui [2026-02-16 19:10] ajaxdavis: add what ever tools you want to that agent etc [2026-02-16 19:10] ajaxdavis: change where the tools are executed, change where the sandbox is launched (different providers) [2026-02-16 19:11] ajaxdavis: for those questions of "can you analyze the codebase" should be a good solution [2026-02-16 19:32] ajaxdavis: well that was way too easy (files: Screenshot_2026-02-17_at_5.31.51_AM.png, Screenshot_2026-02-17_at_5.32.00_AM.png, Screenshot_2026-02-17_at_5.32.11_AM.png) [2026-02-16 19:34] ajaxdavis: can edit repos and push in tpmjs agents ^ [2026-02-16 19:45] traves_theberge: (files: image.png) [2026-02-16 19:46] ajaxdavis: <@1211062099137265723> (files: Screenshot_2026-02-17_at_5.45.44_AM.png, Screenshot_2026-02-17_at_5.46.08_AM.png) [2026-02-16 19:46] ajaxdavis: weird i just deleted that app [2026-02-16 19:47] ajaxdavis: - add per agent conversation stats/usage like other usage pages