CLI: spawn agents in on-demand Cloud sandboxes

CHANGELOG.md

@@ -9,6 +9,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
+- `agent-relay fleet spawn <cli> --sandbox` now spawns an agent in a fresh Cloud Daytona node in one command, with no `--token` required in workspace-only shells. It mounts the current Relayfile workspace at `/workspace` by default; pass `--no-sandbox-relayfile` for a deliberately bare sandbox.
 - `agent-relay observer` mints a scoped, read-only observer token and prints the observer URL built from it, so sharing a live follow-along view no longer requires hand-rolling a `POST /v1/observer-tokens` call. Defaults to a 24-hour token with agent DMs excluded; `--channels`, `--include-dms`, and `--expires` widen it, and `observer list` / `observer revoke <id>` manage existing tokens.
 - `get_observer_url` MCP tool does the same for an orchestrating agent, so a lead can hand the user a follow-along link without shelling out.
 - `@agent-relay/sdk` exports `createObserverToken`, `listObserverTokens`, and `revokeObserverToken`.

packages/cli/README.md

@@ -147,6 +147,13 @@ agent-relay fleet spawn codex \
 # Omit --node for automatic eligible-node placement.
 agent-relay fleet spawn codex --name api-worker --task "Review the current diff."
 
+# Provision a fresh Daytona node, require the current Relayfile workspace to
+# mount at /workspace, wait for readiness, then spawn Codex there.
+agent-relay fleet spawn codex \
+  --sandbox \
+  --name daytona-worker \
+  --task "Review the current workspace and wait for follow-up."
+
 agent-relay message dm send api-worker "Detailed task instructions"
 # wait is the default: it queues for the recipient's next safe idle boundary and
 # can remain unread while that recipient is busy. steer requests immediate
@@ -157,11 +164,19 @@ agent-relay message inbox check --limit 20
 agent-relay fleet release api-worker --reason "Work accepted"
 ```
 
-Commands use the workspace session pinned to the current project. Targeted
+Commands use the workspace session pinned to the current project. Exact-node
 spawn and messaging operations also need an agent identity: pass `--token` or
 set `RELAY_AGENT_TOKEN` to the token returned by
-`agent-relay agent register <lead-name>`. Automatic placement and release need
-only the workspace key.
+`agent-relay agent register <lead-name>`. `fleet spawn --sandbox` needs a Cloud
+login (`agent-relay cloud login`) but does not need an agent token: when one is
+absent, it creates and removes a short-lived launcher identity automatically.
+Automatic placement and release need only the workspace key.
+
+The sandbox path provisions a fresh Daytona instance and makes the Relayfile
+mount mandatory by default, so the spawned worker starts in `/workspace` and
+sees the same synced Relayfile workspace. Pass `--no-sandbox-relayfile` only
+when a deliberately bare sandbox is desired. If provisioning times out or the
+spawn fails, Relay asks Cloud to delete the newly created sandbox.
 
 `--session-ref` is a real CLI resume, not a logical collaboration label. Pass
 the actual Claude session ID or Codex thread ID and target its origin node.