sbxloop 0.2.0__tar.gz → 0.3.0__tar.gz

{sbxloop-0.2.0 → sbxloop-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sbxloop
-Version: 0.2.0
+Version: 0.3.0
 Summary: Agentic loop orchestration on Docker Sandboxes (sbx) with isolated credential domains
 Project-URL: Homepage, https://github.com/brettbergin/sbxloop
 Project-URL: Repository, https://github.com/brettbergin/sbxloop
@@ -19,7 +19,7 @@ Requires-Python: >=3.11
 Requires-Dist: pydantic>=2.7
 Requires-Dist: python-dotenv>=1.0
 Requires-Dist: rich>=13.7
-Requires-Dist: sbxloop-worker==0.2.0
+Requires-Dist: sbxloop-worker==0.3.0
 Requires-Dist: typer>=0.12
 Description-Content-Type: text/markdown
 

{sbxloop-0.2.0 → sbxloop-0.3.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "sbxloop"
-version = "0.2.0"
+version = "0.3.0"
 description = "Agentic loop orchestration on Docker Sandboxes (sbx) with isolated credential domains"
 readme = "README.md"
 requires-python = ">=3.11"
@@ -21,7 +21,7 @@ dependencies = [
     "python-dotenv>=1.0",
     "typer>=0.12",
     "rich>=13.7",
-    "sbxloop-worker==0.2.0",
+    "sbxloop-worker==0.3.0",
 ]
 
 [project.scripts]

{sbxloop-0.2.0 → sbxloop-0.3.0}/src/sbxloop/__init__.py

@@ -6,7 +6,7 @@ agentic layer, and a GitHub-ops sandbox holding only ``GH_TOKEN`` for
 user-facing GitHub interactions. The balanced network policy is the default.
 """
 
-__version__ = "0.2.0"
+__version__ = "0.3.0"
 
 from sbxloop.config import Budgets, Config, load_config
 from sbxloop.engine import LoopEngine, RunResult, run_outcome

{sbxloop-0.2.0 → sbxloop-0.3.0}/src/sbxloop/cli/app.py

@@ -11,13 +11,14 @@ import typer
 from rich.console import Console
 from rich.live import Live
 from rich.table import Table
+from rich.tree import Tree
 
 import sbxloop
 from sbxloop.cli.doctor import run_doctor
 from sbxloop.cli.tui import Dashboard, format_event, plain_printer
 from sbxloop.config import Config, load_config, load_config_with_sources, load_dotenv_file
 from sbxloop.engine.engine import LoopEngine
-from sbxloop.engine.model import RunResult
+from sbxloop.engine.model import RunResult, artifacts_dir
 from sbxloop.engine.store import StateStore
 from sbxloop.errors import SdxloopError
 from sbxloop.sbx.cli import SbxCLI
@@ -93,11 +94,64 @@ def _drive_with_ui(engine: LoopEngine, *, tui: bool, action: Any) -> RunResult:
     return outcome["result"]  # type: ignore[no-any-return]
 
 
-def _finish(result: RunResult) -> None:
+_TREE_MAX_FILES = 50
+
+
+def _human_size(size: int) -> str:
+    value = float(size)
+    for unit in ("B", "KB", "MB"):
+        if value < 1024 or unit == "MB":
+            return f"{value:.0f} {unit}" if unit == "B" else f"{value:.1f} {unit}"
+        value /= 1024
+    raise AssertionError("unreachable")  # pragma: no cover
+
+
+def _artifact_files(root: Path) -> list[Path]:
+    """Regular files under root, hidden files/dirs excluded (an agent's .git
+    would otherwise swamp the listing), sorted for stable output."""
+    return sorted(
+        p
+        for p in root.rglob("*")
+        if p.is_file() and not any(part.startswith(".") for part in p.relative_to(root).parts)
+    )
+
+
+def _artifacts_tree(root: Path, files: list[Path], cap: int = _TREE_MAX_FILES) -> Tree:
+    tree = Tree(f"[bold]{root}[/]")
+    nodes: dict[Path, Tree] = {root: tree}
+    for path in files[:cap]:
+        rel = path.relative_to(root)
+        parent = root
+        for part in rel.parts[:-1]:
+            child = parent / part
+            if child not in nodes:
+                nodes[child] = nodes[parent].add(f"{part}/")
+            parent = child
+        nodes[parent].add(f"{rel.name} [dim]({_human_size(path.stat().st_size)})[/]")
+    if len(files) > cap:
+        tree.add(f"[dim]… +{len(files) - cap} more[/]")
+    return tree
+
+
+def _print_artifacts_summary(result: RunResult, config: Config) -> None:
+    target = artifacts_dir(result, config.state_dir)
+    if target is None or not target.is_dir():
+        return
+    files = _artifact_files(target)
+    if not files:
+        console.print(f"\nartifacts: none produced (workspace: {target})")
+        return
+    via = "live workspace mount" if result.mounted else "harvested from the sandbox"
+    console.print(f"\nartifacts: {len(files)} file(s), {via}")
+    console.print(_artifacts_tree(target, files))
+
+
+def _finish(result: RunResult, config: Config) -> None:
     style = "green" if result.succeeded else "red"
     console.print(f"\nrun [bold cyan]{result.run_id}[/] finished: [bold {style}]{result.state}[/]")
     for task in result.tasks:
         console.print(f"  {task.spec.id}: {task.state}  ({task.spec.title})")
+    _print_artifacts_summary(result, config)
     raise typer.Exit(0 if result.succeeded else 1)
 
 
@@ -125,7 +179,7 @@ def run(
     except SdxloopError as exc:
         console.print(f"[bold red]run failed:[/] {exc}")
         raise typer.Exit(2) from exc
-    _finish(result)
+    _finish(result, config)
 
 
 @app.command()
@@ -134,13 +188,14 @@ def resume(
     tui: Annotated[bool, typer.Option("--tui/--no-tui")] = True,
 ) -> None:
     """Resume an unfinished run (fresh sandboxes, persisted state)."""
-    engine = LoopEngine(load_config())
+    config = load_config()
+    engine = LoopEngine(config)
     try:
         result = _drive_with_ui(engine, tui=tui, action=lambda: engine.resume(run_id))
     except SdxloopError as exc:
         console.print(f"[bold red]resume failed:[/] {exc}")
         raise typer.Exit(2) from exc
-    _finish(result)
+    _finish(result, config)
 
 
 @app.command()
@@ -229,6 +284,49 @@ def logs(
         time.sleep(0.5)
 
 
+@app.command()
+def artifacts(
+    run_id: Annotated[str, typer.Argument(help="Run id.")],
+    path: Annotated[
+        bool, typer.Option("--path", help="Print only the artifacts directory (for scripting).")
+    ] = False,
+    tree: Annotated[
+        bool, typer.Option("--tree/--list", help="Render a file tree instead of a flat list.")
+    ] = False,
+) -> None:
+    """Show where a run's artifacts live on the host, and what is in there."""
+    config = load_config()
+    store = _store(config)
+    try:
+        record = store.get_run(run_id)
+    except SdxloopError as exc:
+        console.print(f"[bold red]{exc}[/]")
+        raise typer.Exit(2) from exc
+    target = artifacts_dir(record, config.state_dir)
+    if target is None:
+        console.print(
+            f"[bold red]run {run_id} has no artifacts:[/] it never provisioned a workspace "
+            f"(state: {record.state})"
+        )
+        raise typer.Exit(2)
+    if path:
+        # bare path on stdout, nothing else — `cd $(sbxloop artifacts R --path)`
+        typer.echo(str(target))
+        return
+    if not target.is_dir():
+        console.print(f"[bold red]artifacts directory is gone:[/] {target}")
+        raise typer.Exit(2)
+    files = _artifact_files(target)
+    via = "live workspace mount" if record.mounted else "harvested copy"
+    console.print(f"run [bold cyan]{run_id}[/]: {len(files)} file(s) ({via}) in [bold]{target}[/]")
+    if tree:
+        console.print(_artifacts_tree(target, files))
+        return
+    for file in files:
+        size = _human_size(file.stat().st_size)
+        console.print(f"  {file.relative_to(target)}  [dim]{size}[/]")
+
+
 @sandbox_app.command("ls")
 def sandbox_ls() -> None:
     """List sbxloop-managed sandboxes."""

{sbxloop-0.2.0 → sbxloop-0.3.0}/src/sbxloop/cli/tui.py

@@ -187,7 +187,7 @@ def format_event(event: Event) -> str:
     parts = [_stamp(event), event.type]
     if event.data.get("task_id"):
         parts.append(f"[{event.data['task_id']}]")
-    for key in ("state", "content", "tool", "op", "line", "message", "outcome"):
+    for key in ("state", "content", "tool", "op", "line", "message", "outcome", "path"):
         if event.data.get(key):
             value = str(event.data[key]).replace("\n", " ")
             parts.append(value[:160])

{sbxloop-0.2.0 → sbxloop-0.3.0}/src/sbxloop/engine/engine.py

@@ -15,6 +15,7 @@ Failure semantics:
 from __future__ import annotations
 
 import json
+import logging
 import time
 from collections.abc import Callable, Sequence
 
@@ -28,15 +29,18 @@ from sbxloop.engine.model import (
 )
 from sbxloop.engine.phases import PhaseRunner, clip
 from sbxloop.engine.store import StateStore
-from sbxloop.errors import BudgetExceededError, SdxloopError, StateError
+from sbxloop.errors import BudgetExceededError, SbxError, SdxloopError, StateError
 from sbxloop.events import EventBus, Hook, HostEventTypes
 from sbxloop.gh.ops import GithubOps
 from sbxloop.gh.reporter import GithubReporterHook
 from sbxloop.ids import new_run_id
 from sbxloop.sbx.cli import SbxCLI
+from sbxloop.sbx.pair import SandboxPair
 from sbxloop.sbx.provision import Provisioner
 from sbxloop.worker.client import WorkerClient
 
+logger = logging.getLogger(__name__)
+
 
 class LoopEngine:
     def __init__(
@@ -101,6 +105,8 @@ class LoopEngine:
         self._set_run_state(run_id, "provisioning")
         provisioner = Provisioner(self.sbx, self.config, self.bus)
         pair = provisioner.ensure_pair(run_id)
+        assert pair.workspace is not None
+        self.store.set_run_workspace(run_id, pair.workspace, pair.mounted)
         try:
             with pair:
                 agent = WorkerClient(
@@ -120,17 +126,29 @@ class LoopEngine:
                     github.install(extras="")
                 detach = self._attach_reporter(github, run_id)
                 try:
-                    phases = PhaseRunner(agent, self.config, run_id, outcome)
-                    state = self._run_phases(run_id, phases, deadline)
+                    phases = PhaseRunner(
+                        agent, self.config, run_id, outcome, workdir=pair.agent_workdir
+                    )
+                    state = self._run_phases(run_id, phases, deadline, pair)
                 finally:
                     detach()
+                    # Harvest even when a phase raised: the sandbox is still
+                    # alive here, and partial artifacts beat none.
+                    self._harvest(run_id, pair)
+                    self._report_artifacts(run_id, pair)
         except SdxloopError:
             # State is already persisted; the exception is the kill signal.
             raise
         self._set_run_state(run_id, state)
         tasks = self.store.get_tasks(run_id)
         self.bus.emit(HostEventTypes.RUN_END, run_id, state=state)
-        return RunResult(run_id=run_id, state=state, tasks=tasks)
+        return RunResult(
+            run_id=run_id,
+            state=state,
+            tasks=tasks,
+            workspace=pair.workspace,
+            mounted=pair.mounted,
+        )
 
     def _attach_reporter(self, github: WorkerClient, run_id: str) -> Callable[[], None]:
         repo = self.config.github.report_repo
@@ -139,7 +157,42 @@ class LoopEngine:
         hook = GithubReporterHook(GithubOps(github, run_id), repo)
         return self.bus.attach_hook(hook)
 
-    def _run_phases(self, run_id: str, phases: PhaseRunner, deadline: float) -> RunState:
+    def _harvest(self, run_id: str, pair: SandboxPair) -> None:
+        """Copy the in-VM work dir out to the host (unmounted runs only).
+
+        Best-effort by design: a failed copy must never fail the run. The
+        trailing ``/.`` copies directory *contents* (docker-style cp) — real
+        sbx cp directory semantics are e2e-validated.
+        """
+        if pair.mounted:
+            return
+        target = self.config.state_dir / "runs" / run_id / "artifacts"
+        target.mkdir(parents=True, exist_ok=True)
+        try:
+            pair.agent.cp_out(f"{pair.agent_workdir}/.", target)
+        except SbxError:
+            logger.warning("artifact harvest failed for run %s", run_id, exc_info=True)
+
+    def _report_artifacts(self, run_id: str, pair: SandboxPair) -> None:
+        target = (
+            pair.workspace
+            if pair.mounted
+            else self.config.state_dir / "runs" / run_id / "artifacts"
+        )
+        if target is None or not target.is_dir():
+            return
+        count = sum(1 for p in target.rglob("*") if p.is_file())
+        self.bus.emit(
+            HostEventTypes.RUN_ARTIFACTS,
+            run_id,
+            path=str(target),
+            files=count,
+            mounted=pair.mounted,
+        )
+
+    def _run_phases(
+        self, run_id: str, phases: PhaseRunner, deadline: float, pair: SandboxPair
+    ) -> RunState:
         tasks = self.store.get_tasks(run_id)
         if not tasks:
             self._set_run_state(run_id, "decomposing")
@@ -177,7 +230,7 @@ class LoopEngine:
                 self.store.update_task(run_id, task)
                 self._emit_task_end(run_id, task)
                 continue
-            self._run_task(run_id, phases, task, deadline)
+            self._run_task(run_id, phases, task, deadline, pair)
             if task.state == "failed":
                 failed_ids.add(task.spec.id)
 
@@ -192,6 +245,7 @@ class LoopEngine:
         phases: PhaseRunner,
         task: TaskRecord,
         deadline: float,
+        pair: SandboxPair,
     ) -> None:
         budgets = self.config.budgets
         if task.state == "pending":
@@ -221,6 +275,9 @@ class LoopEngine:
             else:  # pragma: no cover - defensive
                 raise StateError(f"task {task.spec.id} in unexpected state {task.state}")
 
+        # Task-boundary harvest narrows the loss window on long runs; the
+        # finalize harvest in _drive remains the authoritative sweep.
+        self._harvest(run_id, pair)
         self._emit_task_end(run_id, task)
 
     def _phase_plan(self, run_id: str, phases: PhaseRunner, task: TaskRecord) -> None:

{sbxloop-0.2.0 → sbxloop-0.3.0}/src/sbxloop/engine/model.py

@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 from graphlib import CycleError, TopologicalSorter
+from pathlib import Path
 from typing import Literal
 
 from pydantic import BaseModel, ConfigDict, Field, model_validator
@@ -137,6 +138,10 @@ class RunRecord(_Model):
     state: RunState
     created_at: float
     updated_at: float
+    # Host workspace directory and whether it was live-mounted into the
+    # agent VM (False → artifacts are harvested to runs/<run>/artifacts).
+    workspace: Path | None = None
+    mounted: bool = False
 
 
 class RunResult(_Model):
@@ -145,7 +150,24 @@ class RunResult(_Model):
     run_id: str
     state: RunState
     tasks: list[TaskRecord] = Field(default_factory=list)
+    workspace: Path | None = None
+    mounted: bool = False
 
     @property
     def succeeded(self) -> bool:
         return self.state == "completed"
+
+
+def artifacts_dir(run: RunRecord | RunResult, state_dir: Path) -> Path | None:
+    """The single host directory holding a run's artifacts.
+
+    Mounted runs write straight into the workspace; unmounted runs are
+    harvested to ``runs/<run>/artifacts``. Every reader (run summary,
+    ``sbxloop artifacts``, delivery) resolves through here. None means the
+    run never got as far as provisioning a workspace.
+    """
+    if run.workspace is None:
+        return None
+    if run.mounted:
+        return run.workspace
+    return state_dir / "runs" / run.run_id / "artifacts"

{sbxloop-0.2.0 → sbxloop-0.3.0}/src/sbxloop/engine/phases.py

@@ -48,11 +48,23 @@ def clip(text: str | None, limit: int = OUTPUT_CLIP) -> str:
 class PhaseRunner:
     """Runs the six phases for one run against the agent sandbox's worker."""
 
-    def __init__(self, agent: WorkerClient, config: Config, run_id: str, outcome: str) -> None:
+    def __init__(
+        self,
+        agent: WorkerClient,
+        config: Config,
+        run_id: str,
+        outcome: str,
+        *,
+        workdir: str | None = None,
+    ) -> None:
         self.agent = agent
         self.config = config
         self.run_id = run_id
         self.outcome = outcome
+        # Canonical in-VM working directory for every job in this run: the
+        # discovered workspace mount, or the harvest dir. Evidence and verify
+        # commands must run where the executor wrote its files.
+        self.workdir = workdir
 
     # -- job plumbing ------------------------------------------------------
 
@@ -71,6 +83,7 @@ class PhaseRunner:
             model=self.config.model,
             permission_mode=permission_mode,
             expect=expect,
+            cwd=self.workdir,
             timeout_s=self.config.budgets.per_job_timeout_s,
         )
         result = self.agent.submit(job)
@@ -110,7 +123,7 @@ class PhaseRunner:
             run_id=self.run_id,
             kind="shell.check",
             argv=["sh", "-c", command],
-            cwd=cwd,
+            cwd=cwd or self.workdir,
             timeout_s=self.config.budgets.per_job_timeout_s,
         )
         result = self.agent.submit(job)

{sbxloop-0.2.0 → sbxloop-0.3.0}/src/sbxloop/engine/prompts/execute.md

@@ -3,7 +3,11 @@
 You are the execution stage of an automated engineering loop running with full
 tool access inside an isolated sandbox. Complete the task below by actually
 doing the work: create and edit files, run commands, and verify as you go.
-Work in the current working directory.
+
+Work in the current working directory: it is the run's workspace, synced to
+the host so the user receives everything you put in it. Write all outputs and
+artifacts here — files created anywhere else are lost when the sandbox is
+destroyed.
 
 ## Overall outcome
 

{sbxloop-0.2.0 → sbxloop-0.3.0}/src/sbxloop/engine/store.py

@@ -31,7 +31,9 @@ CREATE TABLE IF NOT EXISTS runs (
     state      TEXT NOT NULL,
     config_json TEXT NOT NULL DEFAULT '{}',
     created_at REAL NOT NULL,
-    updated_at REAL NOT NULL
+    updated_at REAL NOT NULL,
+    workspace  TEXT,
+    mounted    INTEGER NOT NULL DEFAULT 0
 );
 CREATE TABLE IF NOT EXISTS tasks (
     run_id     TEXT NOT NULL,
@@ -68,6 +70,13 @@ CREATE TABLE IF NOT EXISTS events (
 CREATE INDEX IF NOT EXISTS idx_events_run ON events (run_id, seq);
 """
 
+# Columns added after 0.2.0; applied idempotently so existing state
+# databases upgrade in place on open.
+_RUNS_MIGRATIONS = (
+    ("workspace", "ALTER TABLE runs ADD COLUMN workspace TEXT"),
+    ("mounted", "ALTER TABLE runs ADD COLUMN mounted INTEGER NOT NULL DEFAULT 0"),
+)
+
 
 class StateStore:
     def __init__(self, path: Path) -> None:
@@ -77,6 +86,10 @@ class StateStore:
         self._conn.row_factory = sqlite3.Row
         self._conn.execute("PRAGMA journal_mode=WAL")
         self._conn.executescript(_SCHEMA)
+        existing = {row["name"] for row in self._conn.execute("PRAGMA table_info(runs)")}
+        for column, ddl in _RUNS_MIGRATIONS:
+            if column not in existing:
+                self._conn.execute(ddl)
         self._conn.commit()
 
     def close(self) -> None:
@@ -108,30 +121,36 @@ class StateStore:
             raise StateError(f"unknown run {run_id}")
         self._conn.commit()
 
-    def get_run(self, run_id: str) -> RunRecord:
-        row = self._conn.execute("SELECT * FROM runs WHERE run_id = ?", (run_id,)).fetchone()
-        if row is None:
+    def set_run_workspace(self, run_id: str, workspace: Path, mounted: bool) -> None:
+        cursor = self._conn.execute(
+            "UPDATE runs SET workspace = ?, mounted = ?, updated_at = ? WHERE run_id = ?",
+            (str(workspace), int(mounted), time.time(), run_id),
+        )
+        if cursor.rowcount == 0:
             raise StateError(f"unknown run {run_id}")
+        self._conn.commit()
+
+    @staticmethod
+    def _run_record(row: sqlite3.Row) -> RunRecord:
         return RunRecord(
             run_id=row["run_id"],
             outcome=row["outcome"],
             state=row["state"],
             created_at=row["created_at"],
             updated_at=row["updated_at"],
+            workspace=Path(row["workspace"]) if row["workspace"] else None,
+            mounted=bool(row["mounted"]),
         )
 
+    def get_run(self, run_id: str) -> RunRecord:
+        row = self._conn.execute("SELECT * FROM runs WHERE run_id = ?", (run_id,)).fetchone()
+        if row is None:
+            raise StateError(f"unknown run {run_id}")
+        return self._run_record(row)
+
     def list_runs(self) -> list[RunRecord]:
         rows = self._conn.execute("SELECT * FROM runs ORDER BY created_at DESC").fetchall()
-        return [
-            RunRecord(
-                run_id=row["run_id"],
-                outcome=row["outcome"],
-                state=row["state"],
-                created_at=row["created_at"],
-                updated_at=row["updated_at"],
-            )
-            for row in rows
-        ]
+        return [self._run_record(row) for row in rows]
 
     # -- tasks -------------------------------------------------------------
 

{sbxloop-0.2.0 → sbxloop-0.3.0}/src/sbxloop/events.py

@@ -73,6 +73,7 @@ class HostEventTypes:
 
     RUN_START = "run.start"
     RUN_STATE = "run.state"
+    RUN_ARTIFACTS = "run.artifacts"
     RUN_END = "run.end"
     TASK_START = "task.start"
     TASK_STATE = "task.state"

{sbxloop-0.2.0 → sbxloop-0.3.0}/src/sbxloop/sbx/pair.py

@@ -15,9 +15,10 @@ import logging
 import signal
 import threading
 import types
+from pathlib import Path
 from typing import Any
 
-from sbxloop.sbx.sandbox import Sandbox
+from sbxloop.sbx.sandbox import WORK_DIR, Sandbox
 
 logger = logging.getLogger(__name__)
 
@@ -30,11 +31,21 @@ class SandboxPair:
         github: Sandbox,
         *,
         keep: bool = False,
+        workspace: Path | None = None,
+        agent_workdir: str = WORK_DIR,
+        mounted: bool = False,
     ) -> None:
         self.run_id = run_id
         self.agent = agent
         self.github = github
         self.keep = keep
+        # The host directory sbx was given as the run workspace, the in-VM
+        # working directory agent jobs run in, and whether the two are the
+        # same filesystem (mount discovered) — if not, artifacts must be
+        # harvested out with `sbx cp`.
+        self.workspace = workspace
+        self.agent_workdir = agent_workdir
+        self.mounted = mounted
         self._cleaned = False
 
     def __enter__(self) -> SandboxPair:

{sbxloop-0.2.0 → sbxloop-0.3.0}/src/sbxloop/sbx/provision.py

@@ -19,6 +19,7 @@ from __future__ import annotations
 import logging
 import os
 import re
+import secrets
 import shlex
 from collections.abc import Callable, Mapping
 from functools import partial
@@ -30,7 +31,7 @@ from sbxloop.events import EventBus
 from sbxloop.sbx.cli import SbxCLI
 from sbxloop.sbx.models import SandboxRole, SandboxSpec, SecretSpec
 from sbxloop.sbx.pair import SandboxPair
-from sbxloop.sbx.sandbox import ENV_FILE, EVENTS_DIR, JOBS_DIR, RESULTS_DIR, Sandbox
+from sbxloop.sbx.sandbox import ENV_FILE, EVENTS_DIR, JOBS_DIR, RESULTS_DIR, WORK_DIR, Sandbox
 
 logger = logging.getLogger(__name__)
 
@@ -62,6 +63,11 @@ GITHUB_ALLOW_DOMAINS = (
     "objects.githubusercontent.com",
 )
 
+# Candidate roots for the in-VM workspace mount search. Where sbx mounts the
+# host workspace inside the microVM is undocumented; probe, never assume.
+MOUNT_SEARCH_ROOTS = ("/workspace", "/home/agent", "/mnt", "/host", "/root")
+MOUNT_SEARCH_MAXDEPTH = 4
+
 PostCreate = Callable[[Sandbox, SandboxRole], None]
 
 
@@ -162,11 +168,19 @@ class Provisioner:
                     self.post_create(sandbox, spec.role)
                 sandboxes[spec.role] = sandbox
                 self.bus.emit("sandbox.ready", run_id, name=spec.name, role=spec.role)
+            agent_workdir = self._discover_mount(run_id, sandboxes["agent"], workspace)
+            mounted = agent_workdir is not None
+            if agent_workdir is None:
+                agent_workdir = WORK_DIR
+                sandboxes["agent"].mkdirs(agent_workdir)
             return SandboxPair(
                 run_id,
                 agent=sandboxes["agent"],
                 github=sandboxes["github"],
                 keep=self.config.keep_sandboxes,
+                workspace=workspace,
+                agent_workdir=agent_workdir,
+                mounted=mounted,
             )
         except Exception as exc:
             for sandbox in created:
@@ -345,6 +359,53 @@ class Provisioner:
             message=message,
         )
 
+    def _discover_mount(self, run_id: str, sandbox: Sandbox, workspace: Path) -> str | None:
+        """Find where sbx mounted the host workspace inside the agent VM.
+
+        Writes a nonce marker file into the host workspace, then runs one
+        bounded in-sandbox search for it over candidate roots. Returns the
+        in-VM directory containing the marker, or None when discovery fails
+        (→ harvest mode; non-fatal, mirroring _verify_secret_env's
+        probe-don't-assume pattern). The marker is always removed.
+        """
+        marker = f".sbxloop-mount-{secrets.token_hex(8)}"
+        try:
+            (workspace / marker).write_text("")
+        except OSError:
+            logger.warning("mount discovery: cannot write marker into %s", workspace)
+            return None
+        try:
+            command = (
+                f"find -L {' '.join(MOUNT_SEARCH_ROOTS)} "
+                f"-maxdepth {MOUNT_SEARCH_MAXDEPTH} -name {marker} -print 2>/dev/null"
+                " | head -1"
+            )
+            result = sandbox.exec(["sh", "-c", command])
+            hit = result.stdout.strip().splitlines()[-1] if result.stdout.strip() else ""
+        except SbxError:
+            logger.warning("mount discovery failed for %s", sandbox.name, exc_info=True)
+            hit = ""
+        finally:
+            (workspace / marker).unlink(missing_ok=True)
+        if not hit.endswith(f"/{marker}"):
+            self.bus.emit(
+                "sandbox.workspace_mount",
+                run_id,
+                name=sandbox.name,
+                mounted=False,
+                message="workspace mount not found in VM; artifacts will be harvested",
+            )
+            return None
+        mount_dir = hit[: -len(f"/{marker}")] or "/"
+        self.bus.emit(
+            "sandbox.workspace_mount",
+            run_id,
+            name=sandbox.name,
+            mounted=True,
+            path=mount_dir,
+        )
+        return mount_dir
+
     def _apply_plain_env(self, spec: SandboxSpec, sandbox: Sandbox, token: str) -> None:
         """Weaker fallback: write tokens/env into ~/.sbxloop/env.sh in the VM."""
         exports: dict[str, str] = dict(spec.persistent_env)

{sbxloop-0.2.0 → sbxloop-0.3.0}/src/sbxloop/sbx/sandbox.py

@@ -13,6 +13,9 @@ from sbxloop.sbx.models import ExecResult
 # Canonical in-sandbox layout. The sandbox user is `agent` in the official
 # Docker sandbox templates.
 SANDBOX_HOME = "/home/agent"
+# Fallback in-VM working directory when the host-workspace mount cannot be
+# discovered (harvest mode copies it out with `sbx cp` instead).
+WORK_DIR = f"{SANDBOX_HOME}/work"
 SBXLOOP_DIR = f"{SANDBOX_HOME}/.sbxloop"
 JOBS_DIR = f"{SBXLOOP_DIR}/jobs"
 RESULTS_DIR = f"{SBXLOOP_DIR}/results"

{sbxloop-0.2.0 → sbxloop-0.3.0}/src/sbxloop/worker/client.py

@@ -224,6 +224,10 @@ class WorkerClient:
             "--env-file",
             ENV_FILE,
         ]
+        # cwd travels on argv (not only in the job JSON) so the worker
+        # process itself chdirs there — agent SDK sessions inherit it.
+        if job.cwd:
+            argv += ["--cwd", job.cwd]
         # sbx injects secrets through the sandbox session/profile machinery;
         # a bare exec'd process may not see them. Run the worker under a
         # login shell so the sandbox environment is fully loaded.