ai-sandbox-daytona: SDK functions that the adapter does not use — log stream, session stdin, PTY kill, native fs/git, network policy

[mu-hashmi]

Versions: @tanstack/ai-sandbox-daytona 0.2.1, @daytona/sdk v0.191.0.

1. The spawn pump polls the full log; the SDK has a stream

The spawn pump calls getSessionCommandLogs every 400 ms and cuts the new bytes on the client (packages/ai-sandbox-daytona/src/handle.ts). The endpoint has no cursor, so each poll downloads the full log again. Transfer thus grows with the square of the log size. The same SDK method has a WebSocket form: getSessionCommandLogs(sessionId, commandId, onStdout, onStderr) (sdk-typescript/src/Process.ts, v0.191.0). This form follows the log on the server and splits stdout and stderr.

2. writableStdin: false, but session stdin exists

The capability comment says that no host-to-process stdin stream exists. The SDK has one: process.sendSessionCommandInput(sessionId, commandId, data) (v0.191.0). The execute request has a suppressInputEcho flag that keeps the input out of the output log. This can replace the prompt-file redirection for stdin-fed harnesses.

3. killableProcesses: false — correct for plain sessions; a PTY lifts it

The flag is correct for plain session commands. No kill API exists for a plain session command, and the delete-session behavior for a live command is not documented.

PTY sessions are different. process.createPty() returns a PtyHandle with kill(). The endpoint documentation says that PTY deletion terminates the process. A harness under a PTY makes kill() measurable, per the "measured, not asserted" rule in docs/sandbox/providers.md. That unlocks the follow journal strategy.

One effect: a PTY merges stdout and stderr into one stream. The journal carries the structured output, so the loss is small. This adds new data to the "out of scope" note in #1081. That note stays accurate for non-PTY sessions.

4. fs and git are shell re-implementations of native SDK APIs

fs.write puts the full file, as base64, into the command body. This adds 33 percent size and buffers the file through the exec pipeline. fs.read returns the content through the combined output buffer. The SDK has a native sandbox.fs with upload, download, and list. It is binary-safe and has none of these limits.

A native sandbox.git also exists. The header of packages/ai-sandbox/src/git-exec.ts says: "Providers WITH native git (Daytona, Cloudflare) may supply their own implementation instead." Native git.clone takes a path argument, not a shell string. This removes the /workspace remap gap of #1081 item 4 at its source.

5. Create parameters that the config cannot reach

DaytonaSandboxConfig has apiKey, apiUrl, target, snapshot, language, and workdir. These create parameters are in v0.191.0 and are not used:

• networkBlockAll / networkAllowList / domainAllowList — egress control. A map from defineSandboxPolicy network rules turns networkPolicy to true. No other bundled provider reports this capability today.
• autoStopInterval / autoDeleteInterval / ephemeral — lifecycle control. ephemeral: true fits reuse: 'none' runs. autoStopInterval is half of the fix in ai-sandbox-daytona: resume() returns a handle to a stopped sandbox — thread reuse does not work after the 15-minute auto-stop #1083.
• name — the core passes a deterministic input.id to create(), and the adapter discards it. Daytona accepts a name. With a name, an application can find the sandbox again from run context. The comment in provider.create asks for this.