[anycodes]

Description

Provide one authenticated Gateway endpoint for durable Agents Sessions while Codex/Qwen model and tool execution runs in each Session's reusable Express Sandbox. Preserve the existing local Agents API and expose explicit queuing, cancellation targets, retained results and uncertain execution outcomes.

Refs #155
Refs Alibaba-Agent-Sandbox/awesome-templates#295
Refs Alibaba-Agent-Sandbox/agent-sandbox#80

Type of Change

• New feature
• Documentation
• Tests

Changes

• Implement the reviewed 39-operation V1 subset with PostgreSQL state, Submission/Operation receipts, files/artifacts, owner-scoped pagination and bounded SSE.
• Bind Worker revisions and native receipts, preserve uncertainty rather than replaying input, and retain cleanup ownership until confirmed absence.
• Reuse the existing CLI runtime through a signed restart-aware private bridge with cooperative process stopping, tool/output budgets and cross-process stream/delete gates.
• Preserve explicit TLS verification and provider/model credentials. Support bounded public CA arguments and FC's private octet-stream conversion while keeping the public Gateway strict.
• Reject an empty private control revision before state access; preserve omitted/global and nonempty revision behavior. Keep the shared provider error in its lower models layer without changing its identity.

Testing

• Latest complete local make ci, both package type/lint/format/test/build/distribution/install checks, and complete latest-head GitHub Python 3.10/3.11/3.12 matrix, pinned E2B contract, Python→Node engine and both real Docker fixtures. CI: https://github.com/Alibaba-Agent-Sandbox/python-sdk/actions/runs/42192515116
• Actual HTTP with SQLite and real local PostgreSQL, all frozen operations/authentication, CLI fixture subprocesses/files, cancellation/deadlines, retention, real process SIGKILL recovery, native receipt/epoch gaps, PG stop/restart, shared subscriber quota and raw-socket SSE framing.
• Empty revision reproduces four real HTTP failures before correction; new cases preserve complete durable-state snapshots after 400 rejection and retain normal scoped/global control. An existing 150-ms heartbeat fixture's original local/Python-3.10 failures are preserved; a bounded Event/real two-second lease fixes its timing without changing product behavior or weakening assertions.
• Real source FC deployment at cd43e9e reaches normal ready, passes 39 positive operations and 38 authentication rejections, and completes two real model/tool turns. Independent guest execution preserves original tests, passes 4/8 held-out cases and matches tested source to downloaded artifact bytes. Its live idle-Session SSE first frame is 0.169 s with normal EOF at 20.369 s.
• Real signed FC/PostgreSQL drain and exact old-deployment cleanup, generic Express E2E and scoped independent absence are recorded separately. Conditional pause/Snapshot/storage/provider cases remain explicit skips; management-Key creation is excluded because separate consent is unresolved.
• Exact latest CI distribution hashes are verified, matching wheels freshly installed and actual private HTTP boundaries exercised. Prior runtime/CI artifacts are preserved.
• Repository health: 106 passes, one existing recommended-guide warning, zero failures. Full commit hooks pass.

Checklist

• Code follows project conventions and existing local APIs remain supported
• Unit/real-component tests, dated evidence and proposed ADR recorded under .agents/
• English/Chinese user docs and changelog updated
• Client/server versions remain in lockstep; no public artifact overwritten
• No credentials, endpoints, temporary cloud IDs or raw model responses in repository evidence

Definition of Done

The SDK pre-release gates are complete. Package publication, public digest/install readback and the public template's final real-cloud run follow the normal release workflow; they are not fabricated as pre-merge results. The ADR remains proposed until those cross-repository delivery criteria actually finish.

The source cloud run uses cd43e9e, not the final empty-revision package. Active-cancellation inspection initially fails on a private /proc observer download, and the first revision update fails its candidate-health gate; those failures and ongoing independent template/CLI verification remain explicit. They do not become full-template qualification from this SDK merge. Selected OpenAI-inspired wire shapes do not establish OpenAI SDK interoperability, steering, functions, arbitrary MCP or subagents.