spawn/sh/sandbox
B 788e34bd61 feat(sandbox): implement sandbox/t3code — script, Dockerfile, and matrix
Why: sandbox/t3code was the last missing matrix entry. All 7 other clouds
already had t3code implemented; the sandbox lacked the thin-shim script
and Docker image needed to run it in a throwaway container.

- Add sh/sandbox/t3code.sh (mirrors pattern of sandbox/pi.sh)
- Add sh/docker/t3code.Dockerfile (ubuntu:24.04 + Node 22 via n + npm install -g t3)
- Update manifest.json: sandbox/t3code "missing" → "implemented"
- Update sh/sandbox/README.md: add t3code to quick-start and Docker image list

Agent: code-health
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-21 07:17:55 +00:00
..
claude.sh feat(sandbox): promote sandbox from --beta flag to first-class cloud (#3432) 2026-05-21 06:09:04 +00:00
codex.sh feat(sandbox): promote sandbox from --beta flag to first-class cloud (#3432) 2026-05-21 06:09:04 +00:00
cursor.sh feat(sandbox): promote sandbox from --beta flag to first-class cloud (#3432) 2026-05-21 06:09:04 +00:00
hermes.sh feat(sandbox): promote sandbox from --beta flag to first-class cloud (#3432) 2026-05-21 06:09:04 +00:00
junie.sh feat(sandbox): promote sandbox from --beta flag to first-class cloud (#3432) 2026-05-21 06:09:04 +00:00
kilocode.sh feat(sandbox): promote sandbox from --beta flag to first-class cloud (#3432) 2026-05-21 06:09:04 +00:00
openclaw.sh feat(sandbox): promote sandbox from --beta flag to first-class cloud (#3432) 2026-05-21 06:09:04 +00:00
opencode.sh feat(sandbox): promote sandbox from --beta flag to first-class cloud (#3432) 2026-05-21 06:09:04 +00:00
pi.sh feat(sandbox): promote sandbox from --beta flag to first-class cloud (#3432) 2026-05-21 06:09:04 +00:00
README.md feat(sandbox): implement sandbox/t3code — script, Dockerfile, and matrix 2026-05-21 07:17:55 +00:00
t3code.sh feat(sandbox): implement sandbox/t3code — script, Dockerfile, and matrix 2026-05-21 07:17:55 +00:00

Local Sandbox

Run agents inside a throwaway Docker container on your own machine.

Same setup as the local cloud, but the agent runs in an isolated Docker container instead of directly on your host. No account or payment needed. Docker is auto-installed if missing, and the container is removed when the session ends — so the agent can't touch your host filesystem, shell, or SSH keys.

This was previously the --beta sandbox flag on the local cloud. It is now a first-class cloud.

Quick Start

If you have the spawn CLI installed:

spawn claude sandbox
spawn openclaw sandbox
spawn codex sandbox
spawn opencode sandbox
spawn kilocode sandbox
spawn hermes sandbox
spawn junie sandbox
spawn cursor sandbox
spawn pi sandbox
spawn t3code sandbox

Or run directly without the CLI:

bash <(curl -fsSL https://openrouter.ai/labs/spawn/sandbox/claude.sh)
bash <(curl -fsSL https://openrouter.ai/labs/spawn/sandbox/openclaw.sh)
bash <(curl -fsSL https://openrouter.ai/labs/spawn/sandbox/codex.sh)
bash <(curl -fsSL https://openrouter.ai/labs/spawn/sandbox/opencode.sh)
bash <(curl -fsSL https://openrouter.ai/labs/spawn/sandbox/kilocode.sh)
bash <(curl -fsSL https://openrouter.ai/labs/spawn/sandbox/hermes.sh)
bash <(curl -fsSL https://openrouter.ai/labs/spawn/sandbox/junie.sh)
bash <(curl -fsSL https://openrouter.ai/labs/spawn/sandbox/cursor.sh)
bash <(curl -fsSL https://openrouter.ai/labs/spawn/sandbox/pi.sh)
bash <(curl -fsSL https://openrouter.ai/labs/spawn/sandbox/t3code.sh)

Requirements

  • Docker — auto-installed if missing (OrbStack on macOS, docker.io via apt on Linux).
  • OPENROUTER_API_KEY — prompted interactively, or set in the environment.

How it works

The sandbox cloud reuses the local orchestrator with a Docker-wrapped runner:

  1. Ensure Docker is installed and running.
  2. Pull the agent image ghcr.io/openrouterteam/spawn-<agent>:latest and start a container.
  3. Inject OpenRouter credentials and write agent config files inside the container.
  4. Drop into an interactive session via docker exec -it.
  5. Remove the container on exit.

Notes

  • Agents that need a Docker image: claude, codex, cursor, hermes, junie, kilocode, openclaw, opencode, pi, t3code. The container images are built from sh/docker/<agent>.Dockerfile.
  • For host-native execution (no container), use the local cloud instead.