[anycodes]

Summary

• Generation-2 envd (v0.6.1) requires the 5-byte Connect envelope on streaming RPCs (process.Process/Start). The engine was sending raw JSON, which envd rejected as invalid_argument: protocol error: promised N bytes in enveloped message. Streaming calls are enveloped. Unary calls stay raw JSON and use Content-Type: application/json (generation 2 returns HTTP 415 for application/connect+json on ListDir). Generation-1 envd 0.5.x still gets raw streaming JSON and application/connect+json.
• A Connect error trailer is raised as EnvdRpcError with the envd code and message, including across the engine gRPC boundary. commands.run accepts on_stdout and on_stderr.
• Sandbox.server, server_at(), and sandbox.run() do not send the sandbox access token. On the current Express image, an unconfigured agent-sandbox-server returns HTTP 401 when X-Access-Token or Authorization is present. get_access_headers() stays X-Access-Token only, for the platform gateway. A server with no ABX_SERVER_TOKEN now treats an unmatched presented credential as anonymous, so a later image tolerates a forwarded gateway token.

Fixes #15
Fixes #16
Fixes #17

Verified on Express (2026-10-15, provider alicloud-express, SDK 0.3.0)

• Generation 2 template hello-x (envd 0.6.1, agent-sandbox-server on port 9000): Sandbox.create, commands.run stdout/stderr/exit code and on_stdout, files.write/read/list, run("hello", name="Bob") == "Hello, Bob!", network.get_url(9000) plus GET /health with get_access_headers() (200), kill().
• Generation 1 platform template base (envd 0.5.2): commands.run and files.write/read/list. The image entrypoint cannot start the server.

Guide: docs/en/guide/express-quickstart.md (zh mirror linked from both docs indexes).

Test plan

• ruff check and ruff format --check on client-sdk and server-sdk
• mypy src/agent_sandbox and mypy src/agent_sandbox/server
• client pytest -m 'not integration' (1873 passed)
• server pytest (855 passed)
• live Express checks above