Add durable Strands sandbox support by brianstrauch · Pull Request #1768 · temporalio/sdk-python

brianstrauch · 2026-08-20T02:48:29Z

Summary

add an experimental activity-backed TemporalSandbox implementation for the Strands sandbox API
register lazy, worker-lifetime sandbox factories through StrandsPlugin
buffer execution streams for deterministic replay and optionally publish raw StreamChunk values through Workflow Streams
preserve Strands timeout and missing-path errors across the activity boundary
vend the standard sandbox bash and file-editor tools with user overrides
document lifecycle, payload, retry, streaming, and environment-value considerations

Testing

poe test -s -k strands
poe lint
git diff --check

Copilot

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

A timeout is the deterministic outcome the caller's own `timeout` argument asked for, so retrying just re-runs the same hanging command. Under Temporal's unlimited-attempt default this meant SandboxTimeoutError never reached workflow code and the agent could never observe the timeout and adapt. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Every built-in Strands sandbox raises a plain FileNotFoundError from read/write/remove — only list_files raises the SandboxPathNotFoundError subclass — so the old handlers were dead code and a missing path retried forever instead of reaching workflow code. Catch the documented base class instead, and carry the sandbox's own message through so a timeout reports the duration it actually enforced rather than the one the caller requested. Also fix the DockerSandbox import in the README, which is not re-exported from strands.sandbox, and note that the sandbox cache is per worker process. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

patbeqo · 2026-08-27T19:05:19Z

@codex

chatgpt-codex-connector · 2026-08-27T19:09:11Z

Codex Review: Didn't find any major issues. Swish!

Reviewed commit: ef2c383e3c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

patbeqo · 2026-08-28T21:16:12Z

+# workflow
+agent = TemporalAgent(
+    sandbox=TemporalSandbox(
+        "build",


Now that we are using SandboxWorkflowContext do we need the name?

Suggested change

"build",

The name selects the corresponding sandbox defined in StrandsPlugin(sandboxes=...), whereas the context contains the Workflow ID.

Could the factory function handle all sandbox retrievals instead of name map?

TemporalAgent( sandbox=TemporalSandbox(start_to_close_timeout=timedelta(minutes=5)) ) ... plugins=[StrandsPlugin(sandboxes=build_sandbox)]

The name map is good because it's what we already do for MCP, and it allows us to have multiple sandboxes in the same environment.

patbeqo · 2026-09-01T14:15:36Z

@codex

chatgpt-codex-connector · 2026-09-01T14:15:52Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-01T14:23:58.272519Z	`18d709b`	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 18d709b210

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

patbeqo · 2026-09-01T14:34:39Z

+    value: dict[str, Any]
+
+
+class _SandboxRecord:


Can the cache be replaced with a call to the user-provided factory for every activity? The factory can then resolve the correct sandbox using the current context and implement caching appropriate to its backend. This would simplify the lifecycle and cancellation logic, and keep caching policy with the component that understands sandbox identity and cleanup.

I like the idea in principle, but if you were making millions of tool calls you'd have millions of factory calls. It's possible that factory calls are expensive, which could force users to have to implement some type of caching mechanism in their factories to avoid the cost.

xumaple

Overall looks good but provided some comments

xumaple · 2026-09-04T17:11:24Z

+        self, operation: str, input: Any, *, result_type: type | None = None
+    ) -> Any:
+        input.sandbox_name = self._name
+        input.first_execution_run_id = workflow.info().first_execution_run_id


Using first_execution_run_id here is operationally convenient, but it means the sandbox isolation key is not entirely derived from trusted Activity metadata. Arbitrary workflow code on the same task queue can invoke the named Activity and choose a first-execution Run ID. If workflow IDs are reused, or if multiple trust domains share workers, that can potentially reconnect to another chain’s backing environment.

This should at least be documented even if we consider workflow code to be trusted.

xumaple · 2026-09-04T17:19:03Z

+    def _has_record(self, key: _SandboxKey, record: _SandboxRecord) -> bool:
+        return self._records.get(key) is record
+
+    def _evict(self, key: _SandboxKey, record: _SandboxRecord) -> None:


Eviction removes _SandboxRecord, but it does not close the resulting sandbox or adapter. aclose() also awaits creation
and then discards the object.

That may be harmless for DockerSandbox if it is only a lightweight identifier, but other implementations may own HTTP
clients, WebSockets, subprocess handles, tunnels, or leases. How are we planning to handle that?

xumaple · 2026-09-04T17:38:01Z

+
+
+def _timeout_error(err: SandboxTimeoutError, timeout: float | None) -> ApplicationError:
+    # A timeout is the deterministic outcome the caller asked for, so retrying


A timeout is the deterministic outcome the caller asked for

It is? Isn't timeout the definition of something we should retry?

xumaple · 2026-09-04T17:39:29Z

+    ExecutionResult,
+    FileInfo,
+    Sandbox,
+    StreamChunk,


Raw StreamChunk values lack:

sandbox name;

workflow operation/execution ID;

Activity attempt;

chunk sequence;

command versus code execution.

That makes a shared topic difficult to consume correctly. “Use different topics” pushes correlation onto callers and
becomes awkward for concurrent agent tool calls.

I would publish an envelope such as:

SandboxStreamEvent(
sandbox_name=...,
execution_id=...,
attempt=...,
sequence=...,
chunk=...,
)

xumaple · 2026-09-04T17:41:20Z

+All arguments and results cross Temporal's payload boundary and enter workflow
+history. Keep command output and files within the server's configured payload
+size limits; use external storage for large artifacts. In particular, `env`
+values are recorded in history and must not contain secrets.


this suggests that we should maybe use a secret reference system the same way that we did for openai sandboxing?

xumaple · 2026-09-04T17:43:00Z

+activities do not construct a `WorkflowStreamClient` and the workflow does not
+need to host a `WorkflowStream`.
+
+All arguments and results cross Temporal's payload boundary and enter workflow


I don't like when we put things like "cross Temporal's activity boundary" or the like into docs/readmes. llms love to use this type of language but for users who are not super familiar with temporal, this can be very confusing. Prefer pointing to things being "serialized into workflow history" I think that makes a lot more sense for a wider audience.

Add durable Strands sandbox support

7fcd20e

brianstrauch requested review from a team as code owners August 20, 2026 02:48

brianstrauch requested a balanced review from Copilot August 20, 2026 03:02

Copilot AI reviewed Aug 20, 2026

brianstrauch and others added 4 commits August 20, 2026 16:22

Merge remote-tracking branch 'origin/main' into strands-temporal-sandbox

343d0d7

Document sandbox activity retry semantics

ef2c383

patbeqo reviewed Aug 27, 2026

View reviewed changes

Comment thread temporalio/contrib/strands/README.md Outdated

Isolate Strands sandboxes by workflow

da17bd3

patbeqo reviewed Aug 28, 2026

View reviewed changes

Comment thread temporalio/contrib/strands/_sandbox_activity.py

brianstrauch added 2 commits August 30, 2026 17:22

Expose sandbox workflow run context

37031bb

Merge remote-tracking branch 'origin/main' into strands-temporal-sandbox

b8117f7

brianstrauch requested a review from patbeqo August 31, 2026 16:11

Share Strands sandbox activities

18d709b

chatgpt-codex-connector Bot reviewed Sep 1, 2026

View reviewed changes

Comment thread temporalio/contrib/strands/_sandbox_activity.py Outdated

Comment thread temporalio/contrib/strands/_sandbox_activity.py Outdated

Comment thread temporalio/contrib/strands/_sandbox_activity.py Outdated

Comment thread temporalio/contrib/strands/_plugin.py Outdated

patbeqo reviewed Sep 1, 2026

View reviewed changes

brianstrauch added 3 commits September 1, 2026 13:22

Address Strands sandbox review feedback

ac9f222

Fix dependency compatibility lint

6a71a94

Merge remote-tracking branch 'origin/main' into strands-temporal-sandbox

9a78130

brianstrauch requested a review from patbeqo September 1, 2026 21:01

brianstrauch added 3 commits September 1, 2026 14:18

Handle deprecated Strands tool export

e7e4fac

Use Strands shell sandbox tool

5fdb89e

Handle sandbox file operation timeouts

48fc640

patbeqo requested a review from a team September 4, 2026 13:11

xumaple reviewed Sep 4, 2026

View reviewed changes



		def _timeout_error(err: SandboxTimeoutError, timeout: float \| None) -> ApplicationError:
		# A timeout is the deterministic outcome the caller asked for, so retrying

Uh oh!

Conversation

brianstrauch commented Aug 20, 2026

Summary

Testing

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

patbeqo commented Aug 27, 2026

Uh oh!

chatgpt-codex-connector Bot commented Aug 27, 2026

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

patbeqo commented Sep 1, 2026

Uh oh!

chatgpt-codex-connector Bot commented Sep 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

xumaple left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

chatgpt-codex-connector Bot commented Sep 1, 2026 •

edited

Loading