@burdenoff/mcp-libs 2026.522.1 → 2026.525.1

package/dist/modules/sandbox/index.cjs

@@ -93,6 +93,172 @@ var EXTEND_SANDBOX_TTL = `
     extendSandboxTTL(id: $id, additionalSeconds: $additionalSeconds, context: $context) { ${SANDBOX_FIELDS} }
   }
 `;
+var SANDBOX_TEMPLATE_FIELDS = `
+  id name description template isDefault ttlSeconds
+  containers { name image }
+  resources { cpuRequest cpuLimit memoryRequest memoryLimit }
+  storage { mode sizeGi mountPath retainOnDelete }
+  config metadata allowedImages
+  workspaceId createdBy createdAt updatedAt
+`;
+var LIST_SANDBOX_TEMPLATES = `
+  query ListSandboxTemplates($context: ContextInput!, $template: SandboxTemplate, $pagination: SandboxPaginationInput) {
+    listSandboxTemplates(context: $context, template: $template, pagination: $pagination) {
+      items { ${SANDBOX_TEMPLATE_FIELDS} } total hasMore
+    }
+  }
+`;
+var GET_SANDBOX_TEMPLATE = `
+  query GetSandboxTemplate($context: ContextInput!, $id: ID!) {
+    getSandboxTemplate(context: $context, id: $id) { ${SANDBOX_TEMPLATE_FIELDS} }
+  }
+`;
+var CREATE_SANDBOX_TEMPLATE = `
+  mutation CreateSandboxTemplate($input: CreateSandboxTemplateInput!) {
+    createSandboxTemplate(input: $input) { ${SANDBOX_TEMPLATE_FIELDS} }
+  }
+`;
+var UPDATE_SANDBOX_TEMPLATE = `
+  mutation UpdateSandboxTemplate($input: UpdateSandboxTemplateInput!) {
+    updateSandboxTemplate(input: $input) { ${SANDBOX_TEMPLATE_FIELDS} }
+  }
+`;
+var DELETE_SANDBOX_TEMPLATE = `
+  mutation DeleteSandboxTemplate($context: ContextInput!, $id: ID!) {
+    deleteSandboxTemplate(context: $context, id: $id)
+  }
+`;
+var AVAILABLE_SANDBOX_TAGS = `
+  query AvailableSandboxTags($query: String, $limit: Int) {
+    availableSandboxTags(query: $query, limit: $limit) { id key label color }
+  }
+`;
+var GET_SANDBOX_TAGS = `
+  query GetSandboxTags($input: GetSandboxTagsInput!) {
+    getSandboxTags(input: $input) {
+      id entityId entityType tagId source assignedAt assignedBy
+    }
+  }
+`;
+var CREATE_SANDBOX_TAG = `
+  mutation CreateSandboxTag($input: CreateSandboxTagInput!) {
+    createSandboxTag(input: $input) { id key label color }
+  }
+`;
+var TAG_SANDBOX = `
+  mutation TagSandbox($input: TagSandboxInput!) {
+    tagSandbox(input: $input) {
+      id entityId tagId source assignedAt
+    }
+  }
+`;
+var UNTAG_SANDBOX = `
+  mutation UntagSandbox($input: UntagSandboxInput!) {
+    untagSandbox(input: $input)
+  }
+`;
+var REPLACE_SANDBOX_TAGS = `
+  mutation ReplaceSandboxTags($input: ReplaceSandboxTagsInput!) {
+    replaceSandboxTags(input: $input) {
+      id entityId tagId source assignedAt
+    }
+  }
+`;
+var LIST_ALL_SANDBOXES = `
+  query ListAllSandboxes($context: ContextInput!, $filter: SandboxFilterInput, $pagination: SandboxPaginationInput) {
+    listAllSandboxes(context: $context, filter: $filter, pagination: $pagination) {
+      items { ${SANDBOX_FIELDS} } total hasMore
+    }
+  }
+`;
+var LIST_SANDBOX_NODES = `
+  query ListSandboxNodes($context: ContextInput!) {
+    listSandboxNodes(context: $context) {
+      name status allocatableCpu allocatableMemory sandboxPodCount labels
+    }
+  }
+`;
+var GET_ACTIVE_SANDBOXES = `
+  query GetActiveSandboxes($context: ContextInput!) {
+    getActiveSandboxes(context: $context) { ${SANDBOX_FIELDS} }
+  }
+`;
+var GET_RECENT_SANDBOX_ACTIVITY = `
+  query GetRecentSandboxActivity($context: ContextInput!, $limit: Int) {
+    getRecentSandboxActivity(context: $context, limit: $limit) {
+      items { id action actorId status sandboxName sandboxId createdAt }
+      total
+    }
+  }
+`;
+var GET_SANDBOX_STATS = `
+  query GetSandboxStats($context: ContextInput!) {
+    getSandboxStats(context: $context) {
+      activeSandboxes activeUserSandboxes activeInternalSandboxes
+      totalCreated totalDeleted totalUserCreated totalInternalCreated
+      runningNow provisioningNow stoppedNow expiredCount failedCount
+      totalCpuUsed totalMemoryUsed
+    }
+  }
+`;
+var GET_SANDBOX_LOGS = `
+  query GetSandboxLogs($context: ContextInput!, $id: ID!, $containerName: String!, $tailLines: Int) {
+    getSandboxLogs(context: $context, id: $id, containerName: $containerName, tailLines: $tailLines)
+  }
+`;
+var GET_SANDBOX_CONFIG = `
+  query GetSandboxConfig($context: ContextInput!) {
+    getSandboxConfig(context: $context) {
+      id defaultTtlSeconds maxTtlSeconds allowedTemplates
+      maxConcurrentPerUser maxConcurrentPerWorkspace
+      defaultCpuRequest defaultCpuLimit defaultMemoryRequest defaultMemoryLimit
+      workspaceId updatedAt
+    }
+  }
+`;
+var UPDATE_SANDBOX_CONFIG = `
+  mutation UpdateSandboxConfig($input: UpdateSandboxConfigInput!) {
+    updateSandboxConfig(input: $input) {
+      id defaultTtlSeconds maxTtlSeconds allowedTemplates
+      maxConcurrentPerUser maxConcurrentPerWorkspace
+      defaultCpuRequest defaultCpuLimit defaultMemoryRequest defaultMemoryLimit
+      workspaceId updatedAt
+    }
+  }
+`;
+var SANDBOX_EXPORT_JOB_FIELDS = `
+  id workspaceId format status requestedBy rowCount
+  downloadUrl errorMessage expiresAt createdAt updatedAt
+`;
+var EXPORT_SANDBOXES = `
+  mutation ExportSandboxes($input: ExportSandboxesInput!) {
+    exportSandboxes(input: $input) { ${SANDBOX_EXPORT_JOB_FIELDS} }
+  }
+`;
+var GET_SANDBOX_EXPORT_JOB = `
+  query GetSandboxExportJob($workspaceId: ID!, $jobId: ID!, $context: ContextInput!) {
+    getSandboxExportJob(workspaceId: $workspaceId, jobId: $jobId, context: $context) {
+      ${SANDBOX_EXPORT_JOB_FIELDS}
+    }
+  }
+`;
+var LIST_SANDBOX_EXPORT_JOBS = `
+  query ListSandboxExportJobs($workspaceId: ID!, $context: ContextInput!, $pagination: SandboxPaginationInput) {
+    listSandboxExportJobs(workspaceId: $workspaceId, context: $context, pagination: $pagination) {
+      ${SANDBOX_EXPORT_JOB_FIELDS}
+    }
+  }
+`;
+var GET_SANDBOX_ARTIFACT_BYTES = `
+  query GetSandboxArtifactBytes($input: SandboxArtifactBytesInput!) {
+    getSandboxArtifactBytes(input: $input) { filename mimeType size contentBase64 }
+  }
+`;
+var PROXY_SANDBOX_REQUEST = `
+  mutation ProxySandboxRequest($input: ProxySandboxRequestInput!) {
+    proxySandboxRequest(input: $input) { status body }
+  }
+`;
 
 // src/modules/sandbox/tools.ts
 function registerSandboxTools(server, ctx, track) {
@@ -293,6 +459,704 @@ function registerSandboxTools(server, ctx, track) {
       }
     }
   );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "sandbox_templates_list")),
+    {
+      title: "List Sandbox Templates",
+      description: "List sandbox template configurations available in this workspace.",
+      inputSchema: {
+        template: zod.z.string().optional().describe("Filter by template kind"),
+        limit: zod.z.number().optional(),
+        offset: zod.z.number().optional()
+      }
+    },
+    async ({ template, limit, offset }) => {
+      try {
+        const pagination = {};
+        if (limit !== void 0) pagination.limit = limit;
+        if (offset !== void 0) pagination.offset = offset;
+        const data = await ctx.gql.workspace.request(
+          LIST_SANDBOX_TEMPLATES,
+          {
+            template,
+            pagination: Object.keys(pagination).length > 0 ? pagination : void 0
+          }
+        );
+        return jsonResult(data.listSandboxTemplates);
+      } catch (error) {
+        ctx.logger.error("sandbox_templates_list failed", { error });
+        return errorResult(
+          `Failed to list templates: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "sandbox_templates_get")),
+    {
+      title: "Get Sandbox Template",
+      description: "Get a sandbox template by ID.",
+      inputSchema: { id: zod.z.string().describe("Template ID") }
+    },
+    async ({ id }) => {
+      try {
+        const data = await ctx.gql.workspace.request(
+          GET_SANDBOX_TEMPLATE,
+          { id }
+        );
+        return jsonResult(data.getSandboxTemplate);
+      } catch (error) {
+        ctx.logger.error("sandbox_templates_get failed", { error });
+        return errorResult(
+          `Failed to get template: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "sandbox_templates_create")),
+    {
+      title: "Create Sandbox Template",
+      description: "Create a new sandbox template configuration.",
+      inputSchema: {
+        name: zod.z.string(),
+        template: zod.z.enum([
+          "VIBECONTROLS",
+          "AI_BUILDER",
+          "WORKFLOW_MULTI_NODE",
+          "MISC_SHELL",
+          "CUSTOM",
+          "DOCS_BUILDER"
+        ]),
+        description: zod.z.string().optional(),
+        isDefault: zod.z.boolean().optional(),
+        ttlSeconds: zod.z.number().optional()
+      }
+    },
+    async ({ name, template, description, isDefault, ttlSeconds }) => {
+      try {
+        const input = { name, template };
+        if (description !== void 0) input.description = description;
+        if (isDefault !== void 0) input.isDefault = isDefault;
+        if (ttlSeconds !== void 0) input.ttlSeconds = ttlSeconds;
+        const data = await ctx.gql.workspace.request(
+          CREATE_SANDBOX_TEMPLATE,
+          { input }
+        );
+        return jsonResult(data.createSandboxTemplate);
+      } catch (error) {
+        ctx.logger.error("sandbox_templates_create failed", { error });
+        return errorResult(
+          `Failed to create template: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "sandbox_templates_update")),
+    {
+      title: "Update Sandbox Template",
+      description: "Update a sandbox template configuration.",
+      inputSchema: {
+        id: zod.z.string(),
+        name: zod.z.string().optional(),
+        description: zod.z.string().optional(),
+        isDefault: zod.z.boolean().optional(),
+        ttlSeconds: zod.z.number().optional()
+      }
+    },
+    async ({ id, name, description, isDefault, ttlSeconds }) => {
+      try {
+        const input = { id };
+        if (name !== void 0) input.name = name;
+        if (description !== void 0) input.description = description;
+        if (isDefault !== void 0) input.isDefault = isDefault;
+        if (ttlSeconds !== void 0) input.ttlSeconds = ttlSeconds;
+        const data = await ctx.gql.workspace.request(
+          UPDATE_SANDBOX_TEMPLATE,
+          { input }
+        );
+        return jsonResult(data.updateSandboxTemplate);
+      } catch (error) {
+        ctx.logger.error("sandbox_templates_update failed", { error });
+        return errorResult(
+          `Failed to update template: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "sandbox_templates_delete")),
+    {
+      title: "Delete Sandbox Template",
+      description: "Delete a sandbox template configuration.",
+      inputSchema: { id: zod.z.string() }
+    },
+    async ({ id }) => {
+      try {
+        const data = await ctx.gql.workspace.request(
+          DELETE_SANDBOX_TEMPLATE,
+          { id }
+        );
+        return jsonResult({ deleted: data.deleteSandboxTemplate, templateId: id });
+      } catch (error) {
+        ctx.logger.error("sandbox_templates_delete failed", { error });
+        return errorResult(
+          `Failed to delete template: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "sandbox_tags_list")),
+    {
+      title: "List Available Sandbox Tags",
+      description: "List available sandbox tags in the workspace.",
+      inputSchema: {
+        query: zod.z.string().optional(),
+        limit: zod.z.number().optional()
+      }
+    },
+    async ({ query, limit }) => {
+      try {
+        const data = await ctx.gql.workspace.request(
+          AVAILABLE_SANDBOX_TAGS,
+          { query, limit }
+        );
+        return jsonResult(data.availableSandboxTags);
+      } catch (error) {
+        ctx.logger.error("sandbox_tags_list failed", { error });
+        return errorResult(
+          `Failed to list tags: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "sandbox_tags_get")),
+    {
+      title: "Get Sandbox Tags",
+      description: "Get tag assignments for a sandbox.",
+      inputSchema: { sandboxId: zod.z.string() }
+    },
+    async ({ sandboxId }) => {
+      try {
+        const data = await ctx.gql.workspace.request(
+          GET_SANDBOX_TAGS,
+          { input: { sandboxId } }
+        );
+        return jsonResult(data.getSandboxTags);
+      } catch (error) {
+        ctx.logger.error("sandbox_tags_get failed", { error });
+        return errorResult(
+          `Failed to get tags: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "sandbox_tags_create")),
+    {
+      title: "Create Sandbox Tag",
+      description: "Create a new sandbox tag.",
+      inputSchema: {
+        label: zod.z.string(),
+        color: zod.z.string().optional()
+      }
+    },
+    async ({ label, color }) => {
+      try {
+        const input = { label };
+        if (color !== void 0) input.color = color;
+        const data = await ctx.gql.workspace.request(
+          CREATE_SANDBOX_TAG,
+          { input }
+        );
+        return jsonResult(data.createSandboxTag);
+      } catch (error) {
+        ctx.logger.error("sandbox_tags_create failed", { error });
+        return errorResult(
+          `Failed to create tag: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "sandbox_tags_attach")),
+    {
+      title: "Attach Tag to Sandbox",
+      description: "Attach a tag to a sandbox.",
+      inputSchema: {
+        sandboxId: zod.z.string(),
+        tagId: zod.z.string(),
+        source: zod.z.string().optional()
+      }
+    },
+    async ({ sandboxId, tagId, source }) => {
+      try {
+        const input = { sandboxId, tagId };
+        if (source !== void 0) input.source = source;
+        const data = await ctx.gql.workspace.request(TAG_SANDBOX, {
+          input
+        });
+        return jsonResult(data.tagSandbox);
+      } catch (error) {
+        ctx.logger.error("sandbox_tags_attach failed", { error });
+        return errorResult(
+          `Failed to attach tag: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "sandbox_tags_detach")),
+    {
+      title: "Detach Tag from Sandbox",
+      description: "Detach a tag from a sandbox.",
+      inputSchema: {
+        sandboxId: zod.z.string(),
+        tagId: zod.z.string()
+      }
+    },
+    async ({ sandboxId, tagId }) => {
+      try {
+        const data = await ctx.gql.workspace.request(UNTAG_SANDBOX, {
+          input: { sandboxId, tagId }
+        });
+        return jsonResult({ detached: data.untagSandbox, sandboxId, tagId });
+      } catch (error) {
+        ctx.logger.error("sandbox_tags_detach failed", { error });
+        return errorResult(
+          `Failed to detach tag: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "sandbox_tags_replace")),
+    {
+      title: "Replace Sandbox Tags",
+      description: "Replace the full set of tags on a sandbox.",
+      inputSchema: {
+        sandboxId: zod.z.string(),
+        tagIds: zod.z.array(zod.z.string())
+      }
+    },
+    async ({ sandboxId, tagIds }) => {
+      try {
+        const data = await ctx.gql.workspace.request(
+          REPLACE_SANDBOX_TAGS,
+          { input: { sandboxId, tagIds } }
+        );
+        return jsonResult(data.replaceSandboxTags);
+      } catch (error) {
+        ctx.logger.error("sandbox_tags_replace failed", { error });
+        return errorResult(
+          `Failed to replace tags: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "sandbox_admin_list_all")),
+    {
+      title: "List All Sandboxes (admin)",
+      description: "Admin-only list across the entire workspace including internal sandboxes.",
+      inputSchema: {
+        status: zod.z.string().optional(),
+        template: zod.z.string().optional(),
+        limit: zod.z.number().optional(),
+        offset: zod.z.number().optional()
+      }
+    },
+    async ({ status, template, limit, offset }) => {
+      try {
+        const filter = {};
+        if (status !== void 0) filter.status = status;
+        if (template !== void 0) filter.template = template;
+        const pagination = {};
+        if (limit !== void 0) pagination.limit = limit;
+        if (offset !== void 0) pagination.offset = offset;
+        const data = await ctx.gql.workspace.request(
+          LIST_ALL_SANDBOXES,
+          {
+            filter: Object.keys(filter).length > 0 ? filter : void 0,
+            pagination: Object.keys(pagination).length > 0 ? pagination : void 0
+          }
+        );
+        return jsonResult(data.listAllSandboxes);
+      } catch (error) {
+        ctx.logger.error("sandbox_admin_list_all failed", { error });
+        return errorResult(
+          `Failed to list all sandboxes: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "sandbox_admin_nodes_list")),
+    {
+      title: "List Sandbox Nodes",
+      description: "List Kubernetes nodes hosting sandbox workloads with capacity info.",
+      inputSchema: {}
+    },
+    async () => {
+      try {
+        const data = await ctx.gql.workspace.request(
+          LIST_SANDBOX_NODES,
+          {}
+        );
+        return jsonResult(data.listSandboxNodes);
+      } catch (error) {
+        ctx.logger.error("sandbox_admin_nodes_list failed", { error });
+        return errorResult(
+          `Failed to list nodes: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "sandbox_admin_active")),
+    {
+      title: "Get Active Sandboxes",
+      description: "Get currently active sandboxes in the workspace.",
+      inputSchema: {}
+    },
+    async () => {
+      try {
+        const data = await ctx.gql.workspace.request(
+          GET_ACTIVE_SANDBOXES,
+          {}
+        );
+        return jsonResult(data.getActiveSandboxes);
+      } catch (error) {
+        ctx.logger.error("sandbox_admin_active failed", { error });
+        return errorResult(
+          `Failed to get active sandboxes: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "sandbox_admin_activity")),
+    {
+      title: "Recent Sandbox Activity",
+      description: "Get recent sandbox lifecycle activity (create/stop/delete/extend).",
+      inputSchema: { limit: zod.z.number().optional() }
+    },
+    async ({ limit }) => {
+      try {
+        const data = await ctx.gql.workspace.request(
+          GET_RECENT_SANDBOX_ACTIVITY,
+          { limit }
+        );
+        return jsonResult(data.getRecentSandboxActivity);
+      } catch (error) {
+        ctx.logger.error("sandbox_admin_activity failed", { error });
+        return errorResult(
+          `Failed to get activity: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "sandbox_admin_stats")),
+    {
+      title: "Sandbox Stats",
+      description: "Get aggregate sandbox usage statistics for the workspace.",
+      inputSchema: {}
+    },
+    async () => {
+      try {
+        const data = await ctx.gql.workspace.request(
+          GET_SANDBOX_STATS,
+          {}
+        );
+        return jsonResult(data.getSandboxStats);
+      } catch (error) {
+        ctx.logger.error("sandbox_admin_stats failed", { error });
+        return errorResult(
+          `Failed to get stats: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "sandbox_admin_logs")),
+    {
+      title: "Get Sandbox Logs",
+      description: "Fetch logs for a sandbox container.",
+      inputSchema: {
+        id: zod.z.string(),
+        containerName: zod.z.string(),
+        tailLines: zod.z.number().optional()
+      }
+    },
+    async ({ id, containerName, tailLines }) => {
+      try {
+        const data = await ctx.gql.workspace.request(GET_SANDBOX_LOGS, {
+          id,
+          containerName,
+          tailLines
+        });
+        return jsonResult({ logs: data.getSandboxLogs });
+      } catch (error) {
+        ctx.logger.error("sandbox_admin_logs failed", { error });
+        return errorResult(
+          `Failed to get logs: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "sandbox_admin_config_get")),
+    {
+      title: "Get Sandbox Config",
+      description: "Get the per-workspace sandbox configuration limits.",
+      inputSchema: {}
+    },
+    async () => {
+      try {
+        const data = await ctx.gql.workspace.request(
+          GET_SANDBOX_CONFIG,
+          {}
+        );
+        return jsonResult(data.getSandboxConfig);
+      } catch (error) {
+        ctx.logger.error("sandbox_admin_config_get failed", { error });
+        return errorResult(
+          `Failed to get config: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "sandbox_admin_config_set")),
+    {
+      title: "Update Sandbox Config",
+      description: "Update the per-workspace sandbox configuration limits.",
+      inputSchema: {
+        defaultTtlSeconds: zod.z.number().optional(),
+        maxTtlSeconds: zod.z.number().optional(),
+        maxConcurrentPerUser: zod.z.number().optional(),
+        maxConcurrentPerWorkspace: zod.z.number().optional()
+      }
+    },
+    async ({
+      defaultTtlSeconds,
+      maxTtlSeconds,
+      maxConcurrentPerUser,
+      maxConcurrentPerWorkspace
+    }) => {
+      try {
+        const input = {};
+        if (defaultTtlSeconds !== void 0) input.defaultTtlSeconds = defaultTtlSeconds;
+        if (maxTtlSeconds !== void 0) input.maxTtlSeconds = maxTtlSeconds;
+        if (maxConcurrentPerUser !== void 0) input.maxConcurrentPerUser = maxConcurrentPerUser;
+        if (maxConcurrentPerWorkspace !== void 0)
+          input.maxConcurrentPerWorkspace = maxConcurrentPerWorkspace;
+        const data = await ctx.gql.workspace.request(
+          UPDATE_SANDBOX_CONFIG,
+          { input }
+        );
+        return jsonResult(data.updateSandboxConfig);
+      } catch (error) {
+        ctx.logger.error("sandbox_admin_config_set failed", { error });
+        return errorResult(
+          `Failed to update config: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "sandbox_export_create")),
+    {
+      title: "Create Sandbox Export Job",
+      description: "Kick off an async job to export sandboxes for the workspace.",
+      inputSchema: {
+        workspaceId: zod.z.string(),
+        format: zod.z.enum(["CSV", "JSON"]),
+        includeUsageEvents: zod.z.boolean().optional()
+      }
+    },
+    async ({ workspaceId, format, includeUsageEvents }) => {
+      try {
+        const input = { workspaceId, format };
+        if (includeUsageEvents !== void 0) input.includeUsageEvents = includeUsageEvents;
+        const data = await ctx.gql.workspace.request(
+          EXPORT_SANDBOXES,
+          { input }
+        );
+        return jsonResult(data.exportSandboxes);
+      } catch (error) {
+        ctx.logger.error("sandbox_export_create failed", { error });
+        return errorResult(
+          `Failed to create export: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "sandbox_export_get")),
+    {
+      title: "Get Sandbox Export Job",
+      description: "Get a sandbox export job by ID. Poll this to track progress (MCP has no subscriptions).",
+      inputSchema: {
+        workspaceId: zod.z.string(),
+        jobId: zod.z.string()
+      }
+    },
+    async ({ workspaceId, jobId }) => {
+      try {
+        const data = await ctx.gql.workspace.request(
+          GET_SANDBOX_EXPORT_JOB,
+          { workspaceId, jobId }
+        );
+        return jsonResult(data.getSandboxExportJob);
+      } catch (error) {
+        ctx.logger.error("sandbox_export_get failed", { error });
+        return errorResult(
+          `Failed to get export job: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "sandbox_export_list")),
+    {
+      title: "List Sandbox Export Jobs",
+      description: "List sandbox export jobs for a workspace.",
+      inputSchema: {
+        workspaceId: zod.z.string(),
+        limit: zod.z.number().optional(),
+        offset: zod.z.number().optional()
+      }
+    },
+    async ({ workspaceId, limit, offset }) => {
+      try {
+        const pagination = {};
+        if (limit !== void 0) pagination.limit = limit;
+        if (offset !== void 0) pagination.offset = offset;
+        const data = await ctx.gql.workspace.request(
+          LIST_SANDBOX_EXPORT_JOBS,
+          {
+            workspaceId,
+            pagination: Object.keys(pagination).length > 0 ? pagination : void 0
+          }
+        );
+        return jsonResult(data.listSandboxExportJobs);
+      } catch (error) {
+        ctx.logger.error("sandbox_export_list failed", { error });
+        return errorResult(
+          `Failed to list export jobs: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "sandbox_export_get_artifact_bytes")),
+    {
+      title: "Get Sandbox Artifact Bytes",
+      description: "Fetch raw artifact bytes for a sandbox session (base64-encoded, 50 MB cap).",
+      inputSchema: {
+        sandboxId: zod.z.string(),
+        sessionId: zod.z.string(),
+        path: zod.z.string(),
+        onBehalfOfUserId: zod.z.string().optional()
+      }
+    },
+    async ({ sandboxId, sessionId, path, onBehalfOfUserId }) => {
+      try {
+        const input = { sandboxId, sessionId, path };
+        if (onBehalfOfUserId !== void 0) input.onBehalfOfUserId = onBehalfOfUserId;
+        const data = await ctx.gql.workspace.request(
+          GET_SANDBOX_ARTIFACT_BYTES,
+          { input }
+        );
+        return jsonResult(data.getSandboxArtifactBytes);
+      } catch (error) {
+        ctx.logger.error("sandbox_export_get_artifact_bytes failed", { error });
+        return errorResult(
+          `Failed to get artifact bytes: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "sandbox_proxy_request")),
+    {
+      title: "Proxy HTTP Request to Sandbox",
+      description: "Proxy an HTTP request to a service running inside a sandbox container.",
+      inputSchema: {
+        sandboxId: zod.z.string(),
+        method: zod.z.string(),
+        path: zod.z.string(),
+        body: zod.z.unknown().optional(),
+        containerName: zod.z.string().optional()
+      }
+    },
+    async ({ sandboxId, method, path, body, containerName }) => {
+      try {
+        const input = { sandboxId, method, path };
+        if (body !== void 0) input.body = body;
+        if (containerName !== void 0) input.containerName = containerName;
+        const data = await ctx.gql.workspace.request(
+          PROXY_SANDBOX_REQUEST,
+          { input }
+        );
+        return jsonResult(data.proxySandboxRequest);
+      } catch (error) {
+        ctx.logger.error("sandbox_proxy_request failed", { error });
+        return errorResult(
+          `Failed to proxy request: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "sandbox_check")),
+    {
+      title: "Check Sandbox State",
+      description: "Poll a sandbox by ID. MCP has no subscription protocol \u2014 call this in a loop to track lifecycle.",
+      inputSchema: { id: zod.z.string() }
+    },
+    async ({ id }) => {
+      try {
+        const data = await ctx.gql.workspace.request(GET_SANDBOX, { id });
+        return jsonResult(data.getSandbox);
+      } catch (error) {
+        ctx.logger.error("sandbox_check failed", { error });
+        return errorResult(
+          `Failed to poll sandbox: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "sandbox_export_check")),
+    {
+      title: "Check Sandbox Export Job",
+      description: "Poll an export job by ID. MCP has no subscription protocol \u2014 call this in a loop to track progress.",
+      inputSchema: {
+        workspaceId: zod.z.string(),
+        jobId: zod.z.string()
+      }
+    },
+    async ({ workspaceId, jobId }) => {
+      try {
+        const data = await ctx.gql.workspace.request(
+          GET_SANDBOX_EXPORT_JOB,
+          { workspaceId, jobId }
+        );
+        return jsonResult(data.getSandboxExportJob);
+      } catch (error) {
+        ctx.logger.error("sandbox_export_check failed", { error });
+        return errorResult(
+          `Failed to poll export job: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
 }
 
 // src/modules/sandbox/index.ts