Mukil Loganathan (langchain-infra) · Jul 31, 2026 · Jul 31, 2026 · Jul 31, 2026
@@ -5,5 +5,5 @@ maintainers:
     email: ankush@langchain.dev
 description: Helm chart to deploy the langsmith application and all services it depends on.
 type: application
-version: 0.16.0-rc.24
+version: 0.16.0-rc.25
 appVersion: "0.16.28rc1"
@@ -497,6 +497,18 @@ Template containing common environment variables that are used by several servic
       key: polly_encryption_key
       optional: false
 {{- end }}
+{{- if .Values.sandboxes.enabled }}
+- name: SANDBOX_FEATURE_ENABLED
+  value: "true"
+- name: SANDBOX_RUNTIME_V2
+  value: "always"
+- name: SANDBOX_X_SERVICE_AUTH_JWT_SECRET
+  valueFrom:
+    secretKeyRef:
+      name: {{ include "langsmith.secretsName" . }}
+      key: api_key_salt
+      optional: {{ .Values.config.disableSecretCreation }}
+{{- end }}
 {{- end }}
 
 {{/*
@@ -1245,44 +1257,30 @@ Falls back to config.hostname when config.frontendHostname is unset.
 {{- end -}}
 
 {{/*
-Host portion of config.sandboxes.serviceUrlBaseUrl.
+Host portion of sandboxes.serviceUrlBaseUrl.
 */}}
 {{- define "langsmith.sandboxes.serviceUrlHost" -}}
-{{- if .Values.config.sandboxes.serviceUrlBaseUrl -}}
-{{- regexReplaceAll "^https?://" .Values.config.sandboxes.serviceUrlBaseUrl "" -}}
+{{- if .Values.sandboxes.serviceUrlBaseUrl -}}
+{{- regexReplaceAll "^https?://" .Values.sandboxes.serviceUrlBaseUrl "" -}}
 {{- end -}}
 {{- end -}}
 
 {{/*
 Sandbox proxy CA secret name in the LangSmith release namespace.
 */}}
 {{- define "langsmith.sandboxes.proxyCaSecretName" -}}
-{{- if eq .Values.config.sandboxes.proxyCa.mode "existingSecret" -}}
-{{- .Values.config.sandboxes.proxyCa.existingSecretName -}}
+{{- if eq .Values.sandboxes.proxyCa.mode "existingSecret" -}}
+{{- .Values.sandboxes.proxyCa.existingSecretName -}}
 {{- else -}}
-{{- default "smithbox-proxy-ca" .Values.config.sandboxes.proxyCa.secretName -}}
+{{- default "smithbox-proxy-ca" .Values.sandboxes.proxyCa.secretName -}}
 {{- end -}}
 {{- end -}}
 
-{{/*
-Sandbox service auth secret material for chart-created app/runtime Secrets.
-*/}}
-{{- define "langsmith.sandboxes.xServiceAuthJwtSecretValue" -}}
-{{- default (default .Values.config.langsmithLicenseKey .Values.config.apiKeySalt) .Values.config.sandboxes.xServiceAuthJwtSecret -}}
-{{- end -}}
-
-{{/*
-Internal LangSmith platform endpoint used by sandbox runtime callbacks.
-*/}}
-{{- define "langsmith.sandboxes.langsmithInternalEndpoint" -}}
-{{- printf "http://%s-%s.%s.svc.%s:%v" (include "langsmith.fullname" .) .Values.platformBackend.name (.Values.namespace | default .Release.Namespace) .Values.clusterDomain .Values.platformBackend.service.port -}}
-{{- end -}}
-
 {{/*
 Name for the JuiceFS CSI config Secret.
 */}}
 {{- define "langsmith.sandboxes.juicefsCSIConfigSecretName" -}}
-{{- default .Values.config.sandboxes.juicefs.csi.configSecretName .Values.config.sandboxes.juicefs.csi.existingSecretName -}}
+{{- default .Values.sandboxes.juicefs.csi.configSecretName .Values.sandboxes.juicefs.csi.existingSecretName -}}
 {{- end -}}
 
 {{/*
@@ -1292,8 +1290,8 @@ cannot be scoped by resourceNames, but read/update/delete verbs can.
 {{- define "langsmith.sandboxes.juicefsCSISecretResourceNames" -}}
 {{- $names := list
   (include "langsmith.sandboxes.juicefsCSIConfigSecretName" .)
-  (printf "juicefs-%s-secret" .Values.config.sandboxes.juicefs.name)
-  (printf "juicefs-%s-secret" .Values.config.sandboxes.juicefs.csi.pvName)
+  (printf "juicefs-%s-secret" .Values.sandboxes.juicefs.name)
+  (printf "juicefs-%s-secret" .Values.sandboxes.juicefs.csi.pvName)
   (printf "juicefs-%s-secret" (include "langsmith.sandboxes.juicefsHostPVName" .))
 -}}
 {{- $resourceNames := list -}}
@@ -1307,19 +1305,19 @@ cannot be scoped by resourceNames, but read/update/delete verbs can.
 Rendered JuiceFS CSI config Secret data for chart-managed sandbox volumes.
 */}}
 {{- define "langsmith.sandboxes.juicefsCSIConfigSecretData" -}}
-{{- $juicefsRedis := .Values.config.sandboxes.juicefs.redis | default dict -}}
-name: {{ .Values.config.sandboxes.juicefs.name | quote }}
+{{- $juicefsRedis := .Values.sandboxes.juicefs.redis | default dict -}}
+name: {{ .Values.sandboxes.juicefs.name | quote }}
 metaurl: {{ $juicefsRedis.metaURL | quote }}
-storage: {{ .Values.config.sandboxes.juicefs.storage | quote }}
-bucket: {{ .Values.config.sandboxes.juicefs.bucket | quote }}
+storage: {{ .Values.sandboxes.juicefs.storage | quote }}
+bucket: {{ .Values.sandboxes.juicefs.bucket | quote }}
 {{- end -}}
 
 {{/*
 Checksum for the JuiceFS CSI config Secret known to Helm. Existing Secrets use
 the Secret name only because Helm cannot safely hash live external Secret data.
 */}}
 {{- define "langsmith.sandboxes.juicefsCSIConfigSecretChecksum" -}}
-{{- if .Values.config.sandboxes.juicefs.csi.existingSecretName -}}
+{{- if .Values.sandboxes.juicefs.csi.existingSecretName -}}
 {{- printf "existing:%s" (include "langsmith.sandboxes.juicefsCSIConfigSecretName" .) | sha256sum -}}
 {{- else -}}
 {{- include "langsmith.sandboxes.juicefsCSIConfigSecretData" . | sha256sum -}}
@@ -1330,11 +1328,11 @@ the Secret name only because Helm cannot safely hash live external Secret data.
 Derived JuiceFS CSI PV/PVC names for the sandbox-host mount.
 */}}
 {{- define "langsmith.sandboxes.juicefsHostPVName" -}}
-{{- printf "%s-host" .Values.config.sandboxes.juicefs.csi.pvName -}}
+{{- printf "%s-host" .Values.sandboxes.juicefs.csi.pvName -}}
 {{- end -}}
 
 {{- define "langsmith.sandboxes.juicefsHostPVCName" -}}
-{{- printf "%s-host" .Values.config.sandboxes.juicefs.csi.pvcName -}}
+{{- printf "%s-host" .Values.sandboxes.juicefs.csi.pvcName -}}
 {{- end -}}
 
 {{/*
@@ -1391,46 +1389,21 @@ Rendered JuiceFS CSI driver config file.
 {{- define "langsmith.sandboxes.juicefsCSIDriverConfig" -}}
 enableNodeSelector: false
 mountPodPatch:
-{{- toYaml .Values.config.sandboxes.juicefs.csi.mountPodPatch | nindent 2 }}
+{{- toYaml .Values.sandboxes.juicefs.csi.mountPodPatch | nindent 2 }}
 {{- end -}}
 
 {{- define "langsmith.sandboxes.juicefsCSIDriverConfigChecksum" -}}
 {{- include "langsmith.sandboxes.juicefsCSIDriverConfig" . | sha256sum -}}
 {{- end -}}
 
-{{/*
-Creates an optional image reference without falling back to Chart.AppVersion.
-*/}}
-{{- define "langsmith.optionalImage" -}}
-{{- $imageConfig := index .Values.images .component -}}
-{{- if and $imageConfig.repository $imageConfig.tag -}}
-{{- if .Values.images.registry -}}
-{{ .Values.images.registry }}/{{ $imageConfig.repository }}:{{ $imageConfig.tag }}
-{{- else -}}
-{{ $imageConfig.repository }}:{{ $imageConfig.tag }}
-{{- end -}}
-{{- end -}}
-{{- end -}}
-
 {{/*
 Sandbox service account names.
 */}}
 {{- define "langsmith.sandboxes.sandboxHostServiceAccountName" -}}
-{{- if .Values.config.sandboxes.sandboxHost.serviceAccount.create -}}
-{{- default .Values.config.sandboxes.sandboxHost.name .Values.config.sandboxes.sandboxHost.serviceAccount.name | trunc 63 | trimSuffix "-" -}}
-{{- else -}}
-{{- default "default" .Values.config.sandboxes.sandboxHost.serviceAccount.name -}}
-{{- end -}}
-{{- end -}}
-
-{{/*
-Node selector for sandbox-host pods.
-*/}}
-{{- define "langsmith.sandboxes.sandboxHostNodeSelector" -}}
-{{- if .Values.config.sandboxes.sandboxHost.deployment.nodeSelector -}}
-{{- toYaml .Values.config.sandboxes.sandboxHost.deployment.nodeSelector -}}
+{{- if .Values.sandboxes.sandboxHost.serviceAccount.create -}}
+{{- default (printf "%s-%s" (include "langsmith.fullname" .) .Values.sandboxes.sandboxHost.name) .Values.sandboxes.sandboxHost.serviceAccount.name | trunc 63 | trimSuffix "-" -}}
 {{- else -}}
-sandbox.langsmith.com/host: "true"
+{{- default "default" .Values.sandboxes.sandboxHost.serviceAccount.name -}}
 {{- end -}}
 {{- end -}}
 
@@ -1452,26 +1425,6 @@ which default to http:// for local development.
 {{- end -}}
 {{- end -}}
 
-{{/*
-Public API endpoint used by sandbox runtime-v2 dataplane URLs.
-When hostname is unset, keep this relative so browser callers use the same origin.
-*/}}
-{{- define "langsmith.sandboxes.platformEndpoint" -}}
-{{- $basePath := trimAll "/" (default "" .Values.config.basePath) -}}
-{{- if .Values.config.hostname -}}
-  {{- $baseURL := include "langsmith.hostnameWithProtocol" . | trimSuffix "/" -}}
-  {{- if $basePath -}}
-    {{- printf "%s/%s/api" $baseURL $basePath -}}
-  {{- else -}}
-    {{- printf "%s/api" $baseURL -}}
-  {{- end -}}
-{{- else if $basePath -}}
-  {{- printf "/%s/api" $basePath -}}
-{{- else -}}
-  /api
-{{- end -}}
-{{- end -}}
-
 {{/*
 OAuth Authorization Server issuer URL advertised to remote MCP clients.
 Derived from <hostnameWithProtocol>[/basePath]/api. The /api path is fixed because the
@@ -1587,3 +1540,19 @@ Served through the frontend at /mcp (or /<basePath>/mcp).
       optional: {{ .Values.config.disableSecretCreation }}
 {{- end }}
 {{- end -}}
+
+{{/*
+In-cluster platform-backend URL. Also rendered as GO_ENDPOINT in the shared ConfigMap.
+*/}}
+{{- define "langsmith.platformBackendEndpoint" -}}
+{{- printf "http://%s-%s.%s.svc.%s:%v" (include "langsmith.fullname" .) .Values.platformBackend.name (.Values.namespace | default .Release.Namespace) .Values.clusterDomain .Values.platformBackend.service.port -}}
+{{- end -}}
+
+{{/*
+Public API base: scheme, host, any base path, and the /api prefix. Derived from
+config.hostname; relative when unset so browser callers use their own origin. Equal to the
+OAuth issuer today, but kept separate so either can change on its own.
+*/}}
+{{- define "langsmith.publicApiEndpoint" -}}
+{{- include "langsmith.hostnameWithProtocol" . }}{{- with .Values.config.basePath }}/{{ . }}{{- end }}/api
+{{- end -}}
@@ -35,10 +35,10 @@ data:
   {{- end }}
   LANGCHAIN_ENV: "local_kubernetes"
   LANGCHAIN_ENDPOINT: "/{{ if .Values.config.basePath }}{{ .Values.config.basePath }}/{{ end }}api/v1"
-  {{- if .Values.config.sandboxes.enabled }}
-  LANGCHAIN_PLATFORM_ENDPOINT: {{ include "langsmith.sandboxes.platformEndpoint" . | quote }}
+  {{- if .Values.sandboxes.enabled }}
   {{- end }}
-  GO_ENDPOINT: "http://{{ include "langsmith.fullname" . }}-{{ .Values.platformBackend.name }}.{{ .Values.namespace | default .Release.Namespace }}.svc.{{ .Values.clusterDomain }}:{{ .Values.platformBackend.service.port }}"
+  GO_ENDPOINT: {{ include "langsmith.platformBackendEndpoint" . | quote }}
+  LANGSMITH_PUBLIC_API_ENDPOINT: {{ include "langsmith.publicApiEndpoint" . | quote }}
   {{- if .Values.engine.enabled }}
   FORGE_AGENT_LANGGRAPH_URL: "http://{{ include "langsmith.agentFeatures.fullname" (dict "root" . "product" "engineInsightsAgent") }}-{{ .Values.engineInsightsAgent.apiServer.name }}.{{ .Values.namespace | default .Release.Namespace }}.svc.{{ .Values.clusterDomain }}:{{ .Values.engineInsightsAgent.apiServer.service.httpPort }}"
   {{- end }}

@@ -137,7 +137,7 @@ data:
             proxy_pass http://{{ include "langsmith.fullname" . }}-{{ .Values.platformBackend.name }}.{{ .Values.namespace | default .Release.Namespace }}.svc.{{ .Values.clusterDomain }}:{{ .Values.platformBackend.service.port }};
         }
 
-        {{- if .Values.config.sandboxes.enabled }}
+        {{- if .Values.sandboxes.enabled }}
         location /{{ .Values.config.basePath }}/api/v2/sandboxes/ {
             rewrite /{{ .Values.config.basePath }}/api/v2/sandboxes/(.*) /v2/sandboxes/$1  break;
             proxy_set_header Upgrade $http_upgrade;
@@ -772,7 +772,7 @@ data:
             proxy_pass http://{{ include "langsmith.fullname" . }}-{{ .Values.platformBackend.name }}.{{ .Values.namespace | default .Release.Namespace }}.svc.{{ .Values.clusterDomain }}:{{ .Values.platformBackend.service.port }};
         }
 
-        {{- if .Values.config.sandboxes.enabled }}
+        {{- if .Values.sandboxes.enabled }}
         location /api/v2/sandboxes/ {
             rewrite /api/v2/sandboxes/(.*) /v2/sandboxes/$1  break;
             proxy_set_header Upgrade $http_upgrade;

@@ -4,21 +4,9 @@
 - name: "QUEUE_PORT"
   value: {{ .Values.ingestQueue.containerPort | quote }}
 {{ include "langsmith.engine.smithGoEnv" . }}
-{{- if .Values.config.sandboxes.enabled }}
-- name: SANDBOX_FEATURE_ENABLED
-  value: "true"
-- name: SANDBOX_RUNTIME_V2
-  value: "always"
-- name: SANDBOX_K8S_CLUSTER_NAME
-  value: {{ .Values.config.sandboxes.clusterName | quote }}
+{{- if .Values.sandboxes.enabled }}
 - name: SANDBOX_QUEUE_PRIORITY
   value: "1"
-- name: SANDBOX_X_SERVICE_AUTH_JWT_SECRET
-  valueFrom:
-    secretKeyRef:
-      name: {{ include "langsmith.secretsName" . }}
-      key: sandbox_x_service_auth_jwt_secret
-      optional: {{ .Values.config.disableSecretCreation }}
 {{- end }}
 {{- end -}}
 {{- if .Values.ingestQueue.enabled }}

@@ -34,7 +34,7 @@ spec:
             name: {{ include "langsmith.fullname" . }}-{{ .Values.frontend.name }}
             port:
               number: {{ .Values.frontend.service.httpPort }}
-  {{- if and .Values.config.sandboxes.enabled .Values.config.sandboxes.serviceUrlBaseUrl }}
+  {{- if and .Values.sandboxes.enabled .Values.sandboxes.serviceUrlBaseUrl }}
   - host: {{ printf "*.%s" (include "langsmith.sandboxes.serviceUrlHost" .) | quote }}
     http:
       paths:

@@ -14,44 +14,25 @@
       key: langsmith_signing_jwks
       optional: true
 {{ include "langsmith.engine.smithGoEnv" . }}
-{{- if .Values.config.sandboxes.enabled }}
-- name: SANDBOX_FEATURE_ENABLED
-  value: "true"
+{{- if .Values.sandboxes.enabled }}
 - name: SANDBOX_FRONTEND_ENABLED
   value: "true"
-- name: SANDBOX_RUNTIME_V2
-  value: "always"
-- name: SANDBOX_K8S_CLUSTER_NAME
-  value: {{ .Values.config.sandboxes.clusterName | quote }}
 - name: SANDBOX_MAX_CPU_CORES
-  value: {{ .Values.config.sandboxes.limits.maxCpuCores | quote }}
+  value: {{ .Values.sandboxes.quotas.maxCpuCores | quote }}
 - name: SANDBOX_MAX_MEMORY_GB
-  value: {{ .Values.config.sandboxes.limits.maxMemoryGb | quote }}
+  value: {{ .Values.sandboxes.quotas.maxMemoryGb | quote }}
 - name: SANDBOX_MIN_EPHEMERAL_STORAGE_GB
-  value: {{ .Values.config.sandboxes.limits.minEphemeralStorageGb | quote }}
+  value: {{ .Values.sandboxes.quotas.minEphemeralStorageGb | quote }}
 - name: SANDBOX_MAX_EPHEMERAL_STORAGE_GIB
-  value: {{ .Values.config.sandboxes.limits.maxEphemeralStorageGb | quote }}
+  value: {{ .Values.sandboxes.quotas.maxEphemeralStorageGib | quote }}
 - name: SANDBOX_MAX_SANDBOXES
-  value: {{ .Values.config.sandboxes.limits.maxSandboxes | quote }}
-{{- if .Values.config.sandboxes.serviceUrlBaseUrl }}
+  value: {{ .Values.sandboxes.quotas.maxSandboxes | quote }}
+{{- if .Values.sandboxes.serviceUrlBaseUrl }}
+{{- /* Keyed by the name the runtime resolves and stores on each sandbox. */}}
 - name: SANDBOX_SERVICE_URLS
-  value: {{ dict .Values.config.sandboxes.clusterName .Values.config.sandboxes.serviceUrlBaseUrl | toJson | quote }}
-{{- end }}
-- name: SANDBOX_X_SERVICE_AUTH_JWT_SECRET
-  valueFrom:
-    secretKeyRef:
-      name: {{ include "langsmith.secretsName" . }}
-      key: sandbox_x_service_auth_jwt_secret
-      optional: {{ .Values.config.disableSecretCreation }}
-{{- if or (not (empty .Values.config.existingSecretName)) .Values.config.sandboxes.xServiceAuthJwtSecretPrevious }}
-- name: SANDBOX_X_SERVICE_AUTH_JWT_SECRET_PREVIOUS
-  valueFrom:
-    secretKeyRef:
-      name: {{ include "langsmith.secretsName" . }}
-      key: sandbox_x_service_auth_jwt_secret_previous
-      optional: {{ or .Values.config.disableSecretCreation (not (empty .Values.config.existingSecretName)) }}
+  value: {{ dict "incluster" .Values.sandboxes.serviceUrlBaseUrl | toJson | quote }}
 {{- end }}
-{{- if or (not (empty .Values.config.existingSecretName)) .Values.config.sandboxes.callbackSigningJwk }}
+{{- if or (not (empty .Values.config.existingSecretName)) .Values.sandboxes.callbackSigningJwk }}
 - name: LANGSMITH_SANDBOX_CALLBACK_SIGNING_JWK
   valueFrom:
     secretKeyRef:

@@ -1,4 +1,5 @@
-{{- if .Values.config.sandboxes.enabled }}
+{{- /* Vendored from the upstream juicefs-csi-driver chart; re-sync when bumping images.juicefsCSIImage. */}}
+{{- if and .Values.sandboxes.enabled .Values.sandboxes.juicefs.csi.install }}
 {{- $namespace := .Values.namespace | default .Release.Namespace }}
 apiVersion: v1
 kind: ConfigMap
@@ -9,7 +10,6 @@ metadata:
     app.kubernetes.io/component: config
     {{- include "langsmith.sandboxes.juicefsCSILabels" . | nindent 4 }}
   annotations:
-    helm.sh/resource-policy: keep
     {{- include "langsmith.sandboxes.juicefsCSIAnnotations" . | nindent 4 }}
 data:
   config.yaml: |-

@@ -1,7 +1,8 @@
-{{- if .Values.config.sandboxes.enabled }}
+{{- /* Vendored from the upstream juicefs-csi-driver chart; re-sync when bumping images.juicefsCSIImage. */}}
+{{- if and .Values.sandboxes.enabled .Values.sandboxes.juicefs.csi.install }}
 {{- $namespace := .Values.namespace | default .Release.Namespace }}
-{{- $mountImage := include "langsmith.optionalImage" (dict "Values" .Values "Chart" .Chart "component" "juicefsMountImage") }}
-{{- $controllerAnnotations := .Values.config.sandboxes.juicefs.csi.controller.annotations }}
+{{- $mountImage := include "langsmith.image" (dict "Values" .Values "Chart" .Chart "component" "juicefsMountImage") }}
+{{- $controllerAnnotations := .Values.sandboxes.juicefs.csi.controller.annotations }}
 {{- $podAnnotations := mergeOverwrite (dict) (default dict .Values.commonPodAnnotations) $controllerAnnotations }}
 apiVersion: apps/v1
 kind: StatefulSet
@@ -70,10 +71,8 @@ spec:
               value: /var/lib/juicefs/volume
             - name: JUICEFS_CONFIG_PATH
               value: /var/lib/juicefs/config
-            {{- if $mountImage }}
             - name: JUICEFS_CE_MOUNT_IMAGE
               value: {{ $mountImage | quote }}
-            {{- end }}
             - name: JUICEFS_CSI_WEB_PORT
               value: "9567"
             - name: DRIVER_NAME

@@ -1,4 +1,5 @@
-{{- if .Values.config.sandboxes.enabled }}
+{{- /* Vendored from the upstream juicefs-csi-driver chart; re-sync when bumping images.juicefsCSIImage. */}}
+{{- if and .Values.sandboxes.enabled .Values.sandboxes.juicefs.csi.install }}
 apiVersion: storage.k8s.io/v1
 kind: CSIDriver
 metadata:
@@ -7,7 +8,6 @@ metadata:
     app.kubernetes.io/component: driver
     {{- include "langsmith.sandboxes.juicefsCSILabels" . | nindent 4 }}
   annotations:
-    helm.sh/resource-policy: keep
     {{- include "langsmith.sandboxes.juicefsCSIAnnotations" . | nindent 4 }}
 spec:
   attachRequired: false