feat: add sandbox agent HTTP handlers and entry point by fbm3307 · Pull Request #7 · codeready-toolchain/cli-mcp-operator

fbm3307 · 2026-06-02T11:26:45Z

Add AgentState with mutex-protected unassigned/assigned state machine
Implement POST /exec with constant-time bearer token auth (hmac.Equal)
Implement POST /assign for one-time warm-pool token delivery (409 on repeat)
Implement GET /health as unauthenticated readiness probe
Wire cmd/agent/main.go with HTTP server on :8090, Go 1.22+ routing
Graceful shutdown on SIGTERM/SIGINT with 310s timeout (max command + buffer)

Assisted By: Cursor

Summary by CodeRabbit

Release Notes

New Features
- Sandbox agent now runs as HTTP server on port 8090 with three operational endpoints
- Health check endpoint for agent status monitoring
- Authenticated command execution endpoint with request timeout support
- Agent assignment endpoint for pool initialization and state transitions
- Graceful shutdown handling with signal-based termination

- Add AgentState with mutex-protected unassigned/assigned state machine - Implement POST /exec with constant-time bearer token auth (hmac.Equal) - Implement POST /assign for one-time warm-pool token delivery (409 on repeat) - Implement GET /health as unauthenticated readiness probe - Wire cmd/agent/main.go with HTTP server on :8090, Go 1.22+ routing - Graceful shutdown on SIGTERM/SIGINT with 310s timeout (max command + buffer) Co-authored-by: Cursor <cursoragent@cursor.com> Signed-off-by: Feny Mehta <fbm3307@gmail.com>

coderabbitai · 2026-06-02T11:26:57Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: e9f8a50f-6842-49a6-a32e-2ab3035f2418

📥 Commits

Reviewing files that changed from the base of the PR and between 2333a25 and b41ed68.

📒 Files selected for processing (2)

cmd/agent/main.go
pkg/sandbox/handler.go

📜 Recent review details

🧰 Additional context used

📓 Path-based instructions (1)

**

⚙️ CodeRabbit configuration file

-Focus on major issues impacting performance, readability, maintainability and security. Avoid nitpicks and avoid verbosity.

Files:

cmd/agent/main.go
pkg/sandbox/handler.go

🧬 Code graph analysis (2)

cmd/agent/main.go (2)

pkg/sandbox/bash.go (3)

NewDefaultBashConfig (44-46)

NewBashSession (60-66)

Close (120-128)

pkg/version/version.go (2)

Commit (11-11)

BuildTime (14-14)

pkg/sandbox/handler.go (2)

pkg/sandbox/bash.go (3)

BashSession (50-57)

IsAlive (113-117)

Execute (132-320)

pkg/agent/types.go (3)

ExecRequest (5-8)

ExecResponse (11-16)

AssignRequest (19-21)

🔀 Multi-repo context codeready-toolchain/mcp-server-devsandbox, codeready-toolchain/host-operator, codeready-toolchain/toolchain-e2e, codeready-toolchain/mcp-common, codeready-toolchain/api, codeready-toolchain/toolchain-common

Linked repositories findings

codeready-toolchain/mcp-server-devsandbox
- No references found to the new HTTP endpoints (/exec, /assign) or types (AgentState, Handler, BashSession) introduced by the PR. Searches show many usages of os/exec and sandboxctl in:
  - sandbox/main.go — main binary entry for devsandbox MCP server (invokes mcpinit.SandboxMCP) [::codeready-toolchain/mcp-server-devsandbox::sandbox/main.go]
  - multiple tools and test files that call external commands via os/exec (pkg/tools/, pkg/clients/machinery/impl/commandExecutor.go) which indicate similar execution semantics but not the new agent HTTP API [::codeready-toolchain/mcp-server-devsandbox::pkg/tools/; pkg/clients/machinery/impl/commandExecutor.go]
- Deployment and CI reference sandboxctl and container args; no mention of running an HTTP agent on :8090 or SANDBOX_AUTH_TOKEN [::codeready-toolchain/mcp-server-devsandbox::deploy/*; .github/workflows/cd.yml]
codeready-toolchain/host-operator
- RBAC/template files include permissions for "pods/exec" (namespaced role templates) — relevant because the PR implements server-side exec of commands; reviewers should verify that any change to exec behavior or RBAC expectations remain compatible [::codeready-toolchain/host-operator::deploy/templates/nstemplatetiers/*ns_dev.yaml and others]
codeready-toolchain/toolchain-e2e
- test support tiers/checks include Resources: []string{"pods/exec"} in multiple locations — e2e tests expect pod exec capability; any change to how exec is invoked or authenticated may affect tests/infrastructure [::codeready-toolchain/toolchain-e2e::testsupport/tiers/checks.go]
- setup/auth/token.go and other test helpers use os/exec; no usage of the new HTTP endpoints or AgentState [::codeready-toolchain/toolchain-e2e::setup/auth/token.go]
codeready-toolchain/mcp-common, codeready-toolchain/api, codeready-toolchain/toolchain-common
- Searches returned no hits referencing the new endpoints, AgentState, Handler, BashSession, SANDBOX_AUTH_TOKEN, or port 8090. No direct consumers found in these repos. [::codeready-toolchain/mcp-common::], [::codeready-toolchain/api::], [::codeready-toolchain/toolchain-common::]

Summary / implication:

No explicit cross-repo callers of the new agent HTTP API were found. However, multiple repos (host-operator, toolchain-e2e, mcp-server-devsandbox) rely on pods/exec semantics and on executing commands (os/exec / sandboxctl). Reviewers should validate that:
- The agent's command execution behavior (timeouts, stdout/stderr/exit code handling) matches expectations of any consumers or tests that may migrate to use this agent.
- RBAC entries and cluster policies that allow "pods/exec" remain sufficient if the agent changes how exec is performed or delegates to the agent.
- Deployment/CI manifests are updated if the agent must be run separately (SANDBOX_AUTH_TOKEN, port :8090) or if existing binaries/containers are expected to start it.

🔇 Additional comments (11)

pkg/sandbox/handler.go (7)

1-12: LGTM!

14-62: LGTM!

64-84: LGTM!

86-97: LGTM!

99-146: LGTM!

148-167: LGTM!

169-179: LGTM!

cmd/agent/main.go (4)

3-17: LGTM!

19-35: LGTM!

35-52: LGTM!

54-68: LGTM!

Walkthrough

This PR implements the sandbox agent runtime by introducing HTTP handlers for health checks, agent assignment, and command execution, then wires the complete agent bootstrap and graceful shutdown in main(). The agent reads an auth token from environment, initializes state and a bash session, registers the three endpoints, and listens on port 8090 with signal-driven shutdown.

Changes

Sandbox Agent Runtime Implementation

Layer / File(s)	Summary
Agent state tracking `pkg/sandbox/handler.go`	`AgentState` struct with mutex-protected `assigned` and `token` fields, plus methods `IsAssigned()`, `GetToken()`, and `Assign()` to manage one-time assignment transitions.
Handler infrastructure and utilities `pkg/sandbox/handler.go`	`Handler` struct wires together a `BashSession` and `AgentState`, introduces `ErrorResponse` JSON type, provides `writeError()` for consistent JSON error payloads, and `extractBearerToken()` helper to parse Authorization headers.
HTTP endpoint handlers `pkg/sandbox/handler.go`	Three endpoints implemented: `HandleHealth()` returns readiness status; `HandleAssign()` performs one-time token assignment with 409 conflict on repeat; `HandleExec()` enforces assignment, authenticates via Bearer token using constant-time equality, validates JSON command request, executes with timeout, and returns stdout/stderr/exit code/duration.
Agent runtime wiring and shutdown `cmd/agent/main.go`	Reads `SANDBOX_AUTH_TOKEN` environment variable, constructs agent state/bash session/handler, creates HTTP server with registered routes (`POST /exec`, `POST /assign`, `GET /health`), starts server on `:8090`, and implements graceful shutdown via signal handling with 310s timeout context followed by session closure.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

codeready-toolchain/cli-mcp-server#5: Specification and design documentation for the sandbox agent HTTP handlers and main() entry point that this PR implements.

Suggested labels

feature

Suggested reviewers

alexeykazakov

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 60.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main changes: adding sandbox agent HTTP handlers (AgentState, three endpoints) and wiring the entry point (cmd/agent/main.go with server startup).
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch sandbox-1807

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

alexeykazakov

Do not forget to add tests when possible

fbm3307 · 2026-06-03T07:05:32Z

Do not forget to add tests when possible

yes they are to be done as a separate task

coderabbitai Bot added the feature label Jun 2, 2026

alexeykazakov approved these changes Jun 2, 2026

View reviewed changes

fbm3307 merged commit 8dd2c10 into master Jun 3, 2026
3 of 4 checks passed

fbm3307 deleted the sandbox-1807 branch June 3, 2026 07:05

coderabbitai Bot mentioned this pull request Jun 17, 2026

SANDBOX-1809: test- add handler unit tests for sandbox agent #9

Merged

coderabbitai Bot mentioned this pull request Jul 10, 2026

SANDBOX-1812: add typed HTTP client for sandbox agent API #16

Merged

coderabbitai Bot mentioned this pull request Jul 20, 2026

ci: add full golangci-lint, PR image builds, and action v6 #27

Merged

Navigation Menu

Uh oh!

feat: add sandbox agent HTTP handlers and entry point - #7

feat: add sandbox agent HTTP handlers and entry point#7
fbm3307 merged 1 commit into
masterfrom
sandbox-1807

fbm3307 commented Jun 2, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Jun 2, 2026 •

edited

Loading

Linked repositories findings

❌ Failed checks (1 warning)

Uh oh!

alexeykazakov left a comment

Uh oh!

fbm3307 commented Jun 3, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

fbm3307 commented Jun 2, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Release Notes

Uh oh!

coderabbitai Bot commented Jun 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Linked repositories findings

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Suggested labels

Suggested reviewers

❌ Failed checks (1 warning)

Uh oh!

alexeykazakov left a comment

Choose a reason for hiding this comment

Uh oh!

fbm3307 commented Jun 3, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

fbm3307 commented Jun 2, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jun 2, 2026 •

edited

Loading