feat(api-rs): serve tools + overlay to agent sandboxes

[0xdiid]

Agents spawned by the api-rs control plane come up with none of the deployment tools and no organization overlay. The control plane registers credentials at the egress proxy but never gets the tool sources or overlay tree into the agent container, so the boot-time installer has nothing to turn into commands. This affects every ingress riding api-rs.

This finishes the last mile, following the repo-cache architecture: at sandbox boot, an init container pulls the tools from their source repository at a pinned revision into the directory the boot-time installer scans, and the organization overlay rides the same overlay mechanism workflow-host sandboxes already use — same image, same configuration, same mount point — extended to also stage the overlay's system prompt for the agent. One code path shapes the overlay for every kind of sandbox, so the two can't collide or drift. Adding or changing a tool becomes a push to the repository — no image rebuild, live in the next sandbox.

The pull rides the same per-sandbox egress proxy as everything else (the locked-down egress policies allow no direct outbound, and the source host is already on the baseline allowlist), so no network policy changes are needed. A token can be supplied for private sources. Secrets stay untouched: placeholders in the sandbox, real values injected at the proxy. The tools clone is opt-in and additive through the existing values; the overlay needs no new configuration at all — deployments that already configure an overlay image get it in agent sandboxes automatically.

flowchart TB
    GH[("tools repo<br/>(pinned revision)")]
    OI[("overlay image")]

    subgraph CP["control plane"]
        TD["tool discovery<br/>(own tools copy)"] --> ICTL["credential grants"]
    end

    subgraph POD["agent sandbox pod"]
        TB["tools bootstrap<br/>(init)"] --> TV[("tools dir")]
        OB["overlay bootstrap<br/>(init, shared with<br/>workflow hosts)"] --> OV[("overlay dir")]
        OB --> SP[("prompt overlay")]
        TV --> SI["boot-time installer"]
        OV --> SI
        SI -->|"command shims"| AG["agent"]
        SP -->|"appended to base prompt"| AG
    end

    PX["per-sandbox egress proxy"]

    TB -->|"git clone (via proxy)"| PX
    PX -->|"allowlisted"| GH
    OI -->|"image copy"| OB
    AG -->|"tool calls, placeholder creds"| PX
    PX -->|"real creds injected"| EXT["external APIs"]
    ICTL -.->|"renders proxy config"| PX

Loading

One caveat worth calling out: the control plane still reads its own copy of the tools to decide which credentials to grant, so the pinned revision should track the set that copy carries until discovery moves to the same source.

🤖 Generated with Claude Code