docs: use native provider entries in extension guides

Author: anycodes

.agents/evidence/verify/2026-10-18-standard-provider-convergence.md

@@ -60,3 +60,13 @@ PASS/24 SKIP/10 integration deselected in120.01s; earlier2193 count included tho
 ten tests. No skipped test is promoted to pass. Prior real Express and hosted
 server-matrix receipts remain unchanged; no new cloud resources created.
 Latest-head CI follows push. Conditional enabled pause/snapshot remains blocked.
+
+## Native example follow-up
+
+A second maintained-guide scan found six newly accepted native Volume/data-plane/
+existing-account pages still importing synchronous root Sandbox. Corrected both
+languages to explicit ProviderSandbox. The older native adoption page now links
+the separate standard migration route. SDK/provider skills and provider reference
+now state canonical native ABX credentials, standard-only E2B mapping and separate
+AK/SK control-plane authorization. No runtime/code changes or cloud resources.
+Hygiene/health/import smoke and latest-head hosted CI are checked separately.

CHANGELOG.md

@@ -14,6 +14,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/).
 - Reserve create positional arguments for templates and natural language for `--prompt` in the CLI; document migration, source attribution and backend capability limits.
 
 ### Fixed
+- Use explicit native ProviderSandbox in Volume/data-plane adoption examples and distinguish native runtime credentials from control-plane AK/SK in agent guides.
 
 - Reject undeclared native Express PTY before session/context or wire access.
 

agent-sandbox-provider/SKILL.md

@@ -43,7 +43,7 @@ https://registry.agent-sandbox.com. The installer index is
 | `exec` | the manifest plus a process that speaks EPP/1 on stdin/stdout | The API is not E2B-shaped. Any language. No code runs at install time |
 | `node` | `provider.mjs` with `export default create(kit)` | The backend is E2B-shaped but needs a tweak (proxy dial, optional token, other paths). Loaded in the host process; one implementation serves the CLI and every SDK |
 
-Do not start from the Express engine. Do not copy `E2B_API_KEY` into the new provider. That key is Express only.
+Do not start from the Express engine. Do not copy the Express `ABX_SANDBOX_API_KEY` or its standard-entry `E2B_API_KEY` setting into the new provider. Credentials belong to their selected backend.
 
 ## Credentials
 

agent-sandbox-sdk/SKILL.md

@@ -82,11 +82,11 @@ asyncio.run(main())
 - Files on `sb.files`: `write`, `read`, `read_bytes`, `list`, `exists`, `remove`, `make_dir`, `upload`, `download`. On Express, `sb.files.upload_url` and `sb.files.download_url` return an envd URL that still needs header `X-Access-Token`. A provider that does not declare `files.transfer` raises `E8004`. `sb.upload_url` and `sb.download_url` always refuse. Do not invent a signature-only URL.
 - The context manager kills the sandbox. Otherwise call `await sb.kill()`.
 - ProviderSandbox defaults to alicloud-express. Use its configured provider transport; do not hardcode a local engine socket or spawn a separate provider implementation.
-- The only built-in provider is `alicloud-express`. `opensandbox`, `alicloud-container`, `cubesandbox`, and `e2b` are not part of this package. Install them from the catalog with `python -m agent_sandbox.providers install registry:<id> --yes`, then pass that id to `Sandbox.create`. Their notes are in `awesome-providers/<id>/docs/README.md`. Only Express reads `E2B_API_KEY`.
+- The only built-in provider is `alicloud-express`. `opensandbox`, `alicloud-container`, `cubesandbox`, and `e2b` are not part of this package. Install them from the catalog with `python -m agent_sandbox.providers install registry:<id> --yes`, then pass that id to `Sandbox.create`. Their notes are in `awesome-providers/<id>/docs/README.md`. Native ProviderSandbox reads canonical `ABX_SANDBOX_API_KEY`; only the standard entry maps `E2B_*` settings.
 
 | id | What it is | Required environment |
 |---|---|---|
-| `alicloud-express` | Alibaba Cloud Express. The default. Built into the SDK. | `E2B_API_KEY`, or AK/SK |
+| `alicloud-express` | Alibaba Cloud Express. The default. Built into the SDK. | `ABX_SANDBOX_API_KEY`; AK/SK separately authorizes control-plane operations |
 
 URLs, headers, and calls that raise `E8004` for Express are in `references/providers.md`. The `abx` CLI loads `alicloud-express` plus installed `node`, `exec` and `rest` plugins. The four catalog providers are `node`. After `abx provider install alibaba-agent-sandbox/awesome-providers//<id> --allow-unpinned --yes`, `abx --provider <id>` works. A manifest with `kind = "python"` cannot be installed. An in-code `Provider` subclass still works from the SDK only.
 
@@ -237,5 +237,5 @@ Do not upload from a laptop. Do not put a PyPI token in the repo or in chat.
 1. Client code imports `agent_sandbox`. `commands.py` imports `agent_sandbox.server` only.
 2. Named commands are `@command` and `start()` under `if __name__ == "__main__"`.
 3. The default provider's Dockerfile is the FC base image, with no `CMD`.
-4. Do not read or write `E2B_*`.
+4. Keep native provider configuration on `ABX_*`; standard entry configuration may read `E2B_*`. Never substitute Express credentials for another backend.
 5. Do not leak credentials. Do not leave sandboxes running.

agent-sandbox-sdk/references/providers.md

@@ -12,10 +12,10 @@ python -m agent_sandbox.providers install registry:opensandbox --yes
 
 Each provider's config, paths, and `E8004` list are in `awesome-providers/<id>/docs/README.md`. All four are `runtime.kind = "node"` (an ES module, `provider.mjs`). There is no `python`-kind catalog plugin; a manifest with `kind = "python"` cannot be installed. An in-code `Provider` subclass still works from the SDK. Install with `abx provider install alibaba-agent-sandbox/awesome-providers//<id> --allow-unpinned --yes` or the Python module above, then `abx --provider <id>` or `Sandbox.create(provider="<id>")`. The Python SDK reaches a `node` provider through the local Node engine (`abx provider engine serve`, started on demand; `abx` must be on `PATH` or in `ABX_BIN`) using `EngineProvider`. Python `exec` and `rest` manifests still run in the Python process. The built-in `alicloud-express` is the Python builtin provider.
 
-Express is the only provider that reads `E2B_API_KEY`. Catalog providers keep their provider-specific credentials; do not pass the Express E2B_API_KEY to them implicitly.
+Native ProviderSandbox uses `ABX_SANDBOX_API_KEY`, `ABX_SANDBOX_BASE_URL` and `ABX_SANDBOX_DOMAIN`. The standard root entry separately maps E2B settings. Catalog providers keep their provider-specific credentials; never forward the Express key implicitly.
 
 ## alicloud-express
 
-Default. Credentials are `E2B_API_KEY`, or `ALICLOUD_ACCESS_KEY_ID` and `ALICLOUD_ACCESS_KEY_SECRET`. Region is `ALIBABA_CLOUD_REGION_ID` (the CLI also stores it with `abx config set region`). Template images for this provider use the FC Dockerfile in `SKILL.md`.
+Default. Runtime credentials require `ABX_SANDBOX_API_KEY`. `ALICLOUD_ACCESS_KEY_ID` and `ALICLOUD_ACCESS_KEY_SECRET` separately authorize official control-plane operations and cannot substitute for that runtime key. Region is `ALIBABA_CLOUD_REGION_ID` (the CLI also stores it with `abx config set region`). Template images for this provider use the FC Dockerfile in `SKILL.md`.
 
 This reference describes ProviderSandbox, not the standard root Sandbox/AsyncSandbox. Use the configured provider transport rather than hardcoding engine sockets. Existing Express commands/files use the backend envd connection.

docs/en/design/builtin-data-plane.md

@@ -12,7 +12,7 @@ stream requests for envd0.5 and Connect envelopes for envd0.6. The sandbox TTL
 and the create HTTP request timeout remain separate options.
 
 ```python
-from agent_sandbox import Sandbox
+from agent_sandbox import ProviderSandbox as Sandbox
 
 async with await Sandbox.create("base", timeout=300, request_timeout=30) as sb:
     result = await sb.commands.run("echo ready")

docs/en/guide/migrate-from-alicloud-express.md

@@ -2,19 +2,20 @@
 
 This changes your client/tooling, not your cloud provider. Keep your account, region,
 Team, API key, template IDs/aliases, Volumes and RAM roles. Existing resources do not
-need to be recreated just to use the client. There is no implemented zero-change or
-one-click migration. Review the API calls your application actually uses.
+need to be recreated just to use the client. Review the native API calls your application actually uses.
 
 This guide covers Python and the CLI. The public
 [Node SDK](https://github.com/Alibaba-Agent-Sandbox/nodejs-sdk/blob/main/README.md)
 currently provides `ServerClient` and configuration names, not cloud sandbox lifecycle.
 Changing an E2B JavaScript import to that package is not a supported migration.
 
+This page adopts the explicit native ProviderSandbox extensions and their ABX configuration. For the standard sync/async E2B-compatible root entries and import-only supported migration, read the [standard migration guide](migrate-from-e2b.md). Existing backend/runtime restrictions still apply.
+
 ## What changes
 
 | Existing Express application | Agent Sandbox client |
 | --- | --- |
-| `from e2b import Sandbox` | `from agent_sandbox import Sandbox` |
+| `from e2b import Sandbox` | `from agent_sandbox import ProviderSandbox as Sandbox` |
 | Implicit `E2B_API_KEY`, `E2B_API_URL`, `E2B_DOMAIN` | Explicit `ABX_SANDBOX_API_KEY`, `ABX_SANDBOX_BASE_URL`, `ABX_SANDBOX_DOMAIN`; old names are not silently read. |
 | `Sandbox.kill(id)` | `Sandbox.kill_by_id(id)` |
 | `sandbox.get_host(port)` | `sandbox.network.get_host(port)` |
@@ -45,7 +46,7 @@ After installing a compatible client/server release using the
 ```python
 import asyncio
 import os
-from agent_sandbox import Sandbox
+from agent_sandbox import ProviderSandbox as Sandbox
 
 async def main():
     sandbox = await Sandbox.create(

docs/en/guide/provider-commands.md

@@ -12,7 +12,7 @@ The default provider does not advertise `storage.mount`, `ports.domain` or `netw
 The built-in provider accepts `volume_mounts` in `Sandbox.create()` (and `create_sync`):
 
 ```python
-from agent_sandbox import Sandbox
+from agent_sandbox import ProviderSandbox as Sandbox
 
 async with await Sandbox.create(
     provider="alicloud-express",

docs/zh/design/builtin-data-plane.md

@@ -10,7 +10,7 @@ envd0.5 的流请求使用原始 JSON，envd0.6 使用 Connect 封包。
 沙箱 TTL 与创建请求的 HTTP 超时仍是两个独立参数。
 
 ```python
-from agent_sandbox import Sandbox
+from agent_sandbox import ProviderSandbox as Sandbox
 
 async with await Sandbox.create("base", timeout=300, request_timeout=30) as sb:
     result = await sb.commands.run("echo ready")

docs/zh/guide/migrate-from-alicloud-express.md

@@ -1,19 +1,20 @@
 # 在已有极速版账号上使用 Agent Sandbox
 
 这里更换的是客户端和工具，不是云后端。原账号、地域、Team、API Key、模板 ID/别名、
-Volume、RAM 角色都可以继续使用，不必仅为接入客户端而重建资源。目前没有已实现的
-零改动或一键迁移；应核对应用实际使用的 API。
+Volume、RAM 角色都可以继续使用，不必仅为接入客户端而重建资源。采用原生扩展时，应核对应用实际使用的 API。
 
 本指南面向 Python 和 CLI。公开的
 [Node SDK](https://github.com/Alibaba-Agent-Sandbox/nodejs-sdk/blob/main/README.md)
 当前只有 `ServerClient` 和配置名称，没有云端沙箱生命周期；不支持把 E2B JavaScript
 应用仅改导入到该包就完成迁移。
 
+本页介绍显式原生 ProviderSandbox 扩展及其 ABX 配置。标准同步/异步 E2B 兼容根入口，以及受支持范围内仅更换导入的迁移路径，见[标准迁移指南](migrate-from-e2b.md)。云端运行时和账号限制仍然适用。
+
 ## 需要修改的内容
 
 | 原极速版应用 | Agent Sandbox 客户端 |
 | --- | --- |
-| `from e2b import Sandbox` | `from agent_sandbox import Sandbox` |
+| `from e2b import Sandbox` | `from agent_sandbox import ProviderSandbox as Sandbox` |
 | 隐式读取 `E2B_API_KEY`、`E2B_API_URL`、`E2B_DOMAIN` | 显式配置 `ABX_SANDBOX_API_KEY`、`ABX_SANDBOX_BASE_URL`、`ABX_SANDBOX_DOMAIN`，不静默读取旧名称。 |
 | `Sandbox.kill(id)` | `Sandbox.kill_by_id(id)` |
 | `sandbox.get_host(port)` | `sandbox.network.get_host(port)` |
@@ -40,7 +41,7 @@ AK/SK 及镜像仓库前提。API 的 `api_key`、`api_url`、`domain` 仍是对
 ```python
 import asyncio
 import os
-from agent_sandbox import Sandbox
+from agent_sandbox import ProviderSandbox as Sandbox
 
 async def main():
     sandbox = await Sandbox.create(