sandbox

What (and /), , and all hardcoded as the executable of the interactive session. vercel/api#85167 teaches sandbox-init to resolve the account's shell from its passwd entry when the frame carries no command — but the CLI always names one, so that path never ran. The commands that only ever open a shell now send no command and , so the session spawns : the shell the image's user actually declares, as a login shell, with its profile sourced. Commands the user typed are still sent verbatim. Wire-level, the frame goes from to . in is now the single place that decides what a session spawns, and 's is optional. exposes — the command's handler, with optional — so // can ask for a shell instead of fabricating an argv. Most of that file's diff is de-indentation from moving the handler body into a named function. With the same request becomes (), which is sudo's own version of this feature: the target account's passwd shell, as a login shell. It starts in that account's home directory, so no longer survives the + implicit-shell combination. Explicit commands under are unchanged. Nothing is echoed as for an implicit shell anymore: the sandbox picks the executable, so the CLI would only be printing a guess. api-side coordination No changes to #85167 are needed. Its empty-command path passes through to verbatim, so the client-supplied lands on the resolved shell — verified against and the controller's bridge on , neither of which rejects an empty . The dependency runs one way: this PR should land after #85167 is deployed. Against an older sandbox-init, an empty command reaches and the session fails to start. is spelled out because that is the form bash, zsh, fish and sudo all accept. If we ever need to support a shell that only takes , that translation belongs next to the passwd lookup in sandbox-init, where the shell is actually known — not in the CLI. Testing and in . New coverage: — over the four combinations (implicit/explicit command × sudo), plus sessions driven against a real local WebSocket server asserting the frame that goes over the wire, and that only an explicit command is echoed. — , , and reach with no execution; still carries the command it was given. Verified these fail against the old . 🤖 Generated with Claude Code

Why now accepts (explicit network, explicit opt-out) and applies a project-level Secure Compute default when the field is omitted. The SDK needs to expose that intent. What Adds to params and forwards it through . Omitted means inherit the project default; means create without Secure Compute. Minor changeset for . Validation Client tests assert an explicit string and an explicit are serialized into the request body, and that the key is absent when the option is omitted (so the API can apply the project default).