Integrate E2B-compatible providers and template discovery

apps/docs/content/docs/admin-api.mdx

@@ -95,7 +95,11 @@ require the observed `expected_generation`, including zero at first setup. Reque
 Response `resources.allocations` and `resources.pending` are cleanup counts, not
 CPU, memory or disk settings. E2B accepts a write-only key and exact template build
 instead of a node Runtime release, and provisions without a node installation. E2B
-may omit `resources` to adopt the validated build's CPU and memory; responses show
+may omit `resources` to adopt the validated build's CPU and memory. An E2B-compatible
+service may also supply paired `e2b.api_url` and `e2b.domain`; omitted selectors
+use official E2B. Responses expose these addresses but never the key, and changing
+them requires the same drained maintenance transition as changing the template.
+Responses show
 the build as read at selection time in `e2b.template_build`. Microsandbox responses
 return its idle `suspension` policy; other providers return null.
 

apps/docs/content/docs/api-reference/core/sandbox-manager.mdx

@@ -46,6 +46,14 @@ _openapi:
           Restores admission but never restores Sessions already archived. With
           no reset running this is an idempotent read, provided the generation
           still matches.
+      - content: >-
+          Core key only. Uses a transient E2B credential and endpoint through
+          the pinned SDK helper; returns safe template metadata. Does not save
+          the credential or allocate compute.
+      - content: >-
+          Core key only. Reads one template through the pinned SDK helper with a
+          transient E2B credential. Returns ready builds only, without
+          allocating compute.
       - content: >-
           Core key only. Does not grant project resource access. Responses
           contain only explicit safe fields.
@@ -68,4 +76,4 @@ _openapi:
 
 {/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}
 
-<APIPage document={"core-api"} operations={[{"path":"/core/v1/sandbox/deployment","method":"get"},{"path":"/core/v1/sandbox/deployment","method":"post"},{"path":"/core/v1/sandbox/deployment","method":"put"},{"path":"/core/v1/sandbox/deployment/reset","method":"post"},{"path":"/core/v1/sandbox/deployment/reset","method":"delete"},{"path":"/core/v1/sandbox/enrollment-tokens","method":"post"},{"path":"/core/v1/sandbox/nodes","method":"get"},{"path":"/core/v1/sandbox/nodes/{node_id}","method":"get"},{"path":"/core/v1/sandbox/nodes/{node_id}","method":"patch"},{"path":"/core/v1/sandbox/nodes/{node_id}","method":"delete"},{"path":"/core/v1/sandbox/nodes/{node_id}/allocations","method":"get"}]} webhooks={[]} hasHead={true} />
+<APIPage document={"core-api"} operations={[{"path":"/core/v1/sandbox/deployment","method":"get"},{"path":"/core/v1/sandbox/deployment","method":"post"},{"path":"/core/v1/sandbox/deployment","method":"put"},{"path":"/core/v1/sandbox/deployment/reset","method":"post"},{"path":"/core/v1/sandbox/deployment/reset","method":"delete"},{"path":"/core/v1/sandbox/e2b/templates","method":"post"},{"path":"/core/v1/sandbox/e2b/templates/{template_id}/builds","method":"post"},{"path":"/core/v1/sandbox/enrollment-tokens","method":"post"},{"path":"/core/v1/sandbox/nodes","method":"get"},{"path":"/core/v1/sandbox/nodes/{node_id}","method":"get"},{"path":"/core/v1/sandbox/nodes/{node_id}","method":"patch"},{"path":"/core/v1/sandbox/nodes/{node_id}","method":"delete"},{"path":"/core/v1/sandbox/nodes/{node_id}/allocations","method":"get"}]} webhooks={[]} hasHead={true} />

apps/docs/content/docs/configure.mdx

@@ -160,7 +160,11 @@ file. The database owns the saved values.
 
 E2B takes no `runtime`, and Web sends no resources for it: Core adopts the CPU and
 memory of the ready template build `template-id:build-uuid`, and supplied values must
-match it. Docker has no separate disk quota.
+match it. For an E2B-compatible service, enter both its HTTPS API origin and
+sandbox data-plane domain in the setup wizard. Leaving both blank uses official
+E2B. The API host must be the data-plane domain or one of its subdomains.
+Changing either address requires draining the deployment in maintenance.
+Docker has no separate disk quota.
 
 Changing backend type or E2B team requires an explicit reset and a new setup.
 Same-team E2B template, resource and key changes apply online through the Core API:

apps/docs/content/docs/install-options.mdx

@@ -61,6 +61,8 @@ create another process configuration file.
 | `--accept-docker-risks` | Accept Docker's weaker isolation without an interactive prompt |
 | `--e2b-api-key-file FILE` | With E2B: absolute path to a private key file, no group/other access and at most 4 KiB |
 | `--e2b-template ID:BUILD` | With E2B: ready template build as `template-id:build-uuid` |
+| `--e2b-api-url URL` | With E2B: compatible service HTTPS API origin; use together with `--e2b-domain` |
+| `--e2b-domain DOMAIN` | With E2B: sandbox data-plane DNS suffix; use together with `--e2b-api-url` |
 | `--core-key-file FILE` | With Web-only: absolute path to a private file containing the existing Core key, at least 32 characters |
 
 See [deployment modes](/install#modes), [native Core](/install#native-core) and

apps/docs/content/docs/public-api.mdx

@@ -56,7 +56,7 @@ with the Core key.
 | `projects/{project_id}/environments/{environment_id}/executor-credentials[/{key_id}]` | Executor credentials for a self-hosted Environment | [Executor credentials](https://github.com/MiniMax-AI/parsar-core/blob/f45a4198aca79bf252412c55cad3647f5d704515/contracts/agents-api/environment-executor-credentials.md) |
 | `installation` | Public URL, API base URL, source commit, the installer's process settings and what is bound to the public URL; available before any deployment | [Installation](https://github.com/MiniMax-AI/parsar-core/blob/f45a4198aca79bf252412c55cad3647f5d704515/contracts/agents-api/installation.md) |
 | `metrics` | Core's own process metrics | [Core metrics](https://github.com/MiniMax-AI/parsar-core/blob/f45a4198aca79bf252412c55cad3647f5d704515/contracts/agents-api/core-metrics.md) |
-| `sandbox/deployment[/reset]`, `sandbox/enrollment-tokens`, `sandbox/nodes[/{node_id}[/allocations]]` | Sandbox deployment, node enrollment tokens and nodes | [Sandbox deployment](https://github.com/MiniMax-AI/parsar-core/blob/f45a4198aca79bf252412c55cad3647f5d704515/contracts/agents-api/sandbox-deployment.md), [node operations](https://github.com/MiniMax-AI/parsar-core/blob/f45a4198aca79bf252412c55cad3647f5d704515/services/agents-api/HOSTED-SANDBOX-MANAGER.md), [node host history](https://github.com/MiniMax-AI/parsar-core/blob/f45a4198aca79bf252412c55cad3647f5d704515/contracts/agents-api/node-host-history.md) |
+| `sandbox/deployment[/reset]`, `sandbox/e2b/templates[/{template_id}/builds]`, `sandbox/enrollment-tokens`, `sandbox/nodes[/{node_id}[/allocations]]` | Core Web server or operator scripts with the Core key: sandbox deployment, read-only E2B template discovery, node enrollment tokens and nodes | [Sandbox deployment](https://github.com/MiniMax-AI/parsar-core/blob/f45a4198aca79bf252412c55cad3647f5d704515/contracts/agents-api/sandbox-deployment.md), [node operations](https://github.com/MiniMax-AI/parsar-core/blob/f45a4198aca79bf252412c55cad3647f5d704515/services/agents-api/HOSTED-SANDBOX-MANAGER.md), [node host history](https://github.com/MiniMax-AI/parsar-core/blob/f45a4198aca79bf252412c55cad3647f5d704515/contracts/agents-api/node-host-history.md) |
 | `harnesses`, `harnesses/{harness}/model-configuration` | Supported harnesses and each harness's deployment default model configuration (write-only provider key) | [Model execution](https://github.com/MiniMax-AI/parsar-core/blob/f45a4198aca79bf252412c55cad3647f5d704515/contracts/agents-api/model-execution.md#deployment-defaults) |
 
 ## Machine connection API

apps/docs/content/guide-sources.json

@@ -5,11 +5,11 @@
     "docs/design-principles.md": "a33acd6e7bc80105a5c934d0be214c0cff59103e96c098f5b09179c86156c01d",
     "docs/web/architecture.md": "80bdb8053c06c2b2030b193aae17d5434545f9c72af50e9d3df3ade522fe25ed",
     "docs/getting-started/install.md": "a437b90c2cc4755e0fd760066837bfec96e9aa4a4a4bc5bc865b8ad02162c197",
-    "docs/getting-started/install-options.md": "aac219f367619036aa01573a295802fb8f0418e3d6db931efcfc88f17cf7734c",
-    "docs/configuration.md": "ca7aa789f6a2a63a493ecf6ebfc083adea94218215e781980cd35ae2aac42298",
+    "docs/getting-started/install-options.md": "c806f8f229edccc8bcc4a853976e330cfee6025c9d3d00f6960fe2ee97a8c1d6",
+    "docs/configuration.md": "77e24331a51f0053e968f8b18daee7d0517ec635842e0b01fca4d93c0a26d734",
     "docs/web/core-connection.md": "46f86520e70bf41079708e2c398655aa9087ad9488c8e661d9a73035d11098c4",
     "docs/getting-started/quickstart.md": "238b4de1137edb8c2998b38f4525fea345a19fd4de7a455aa9c4c9e4fc3c9b36",
-    "docs/api/README.md": "628deeb777b7203b42e77a253e91af0f05ca690cd10cb1e08b53b64d62cee923",
+    "docs/api/README.md": "e9af18bf54c0625ab63a01d2cba4337ece555d570bddc6471767e406501a5bc1",
     "contracts/agents-api/execution-tools.md": "e0b61f6c0c236c362186c5f6d0ad69a16dd8a8d9afabe1329a1fe22e5f4a71e9",
     "docs/api/public-agent-api.md": "5b04e5ec9311df851376f66fc1584dd48ca123cd8c26ca63277c10b9172e9955",
     "contracts/agents-api/environments.md": "4c4b9423b22919d6aa6bd98d96422e1a8d610d3442d4cf7731a575bd31fd43f0",
@@ -18,7 +18,7 @@
     "docs/self-hosted-native.md": "8fc6beccf28ace62e126faa03a923c669298b35213159c5d67b9ac3c7272741b",
     "apps/web/public/onboarding/monitor-en.webp": "29dc220cb1250c7016b7c4bf7f30e9510b07c07b814a48c3aa9303b2d76f20b2",
     "docs/web/README.md": "9fce295f6f6ff04acefe338679c1e54723e123dd0027a778202adfa9ab95b6c4",
-    "docs/api/web-management.md": "aaae99269518e1fffe02f572d04fdbeb8da5342c309b5016ac31c10a6604dd8e",
+    "docs/api/web-management.md": "ec9a583c0a94845082ec31c7220ddcfb9aff7147c63fb36fa4c87463570f1b8c",
     "contracts/agents-api/runtime-observability-api.md": "cd46e777fe716a7e76374f4655c96dfbad9d8be1bfca6203ed6118ab87874c2b",
     "docs/getting-started/operations.md": "2cba15fe56936cbc51e2ec8b8a888686273b21f729711e45c14ca6e32758663d",
     "docs/user-guide.md": "a601c7f9df02c3bfe9c4ca3a43b91ab5721f3f8e904fccd116418dbdc1665a53",
@@ -33,11 +33,11 @@
     "content/docs/concepts.mdx": "ab0508c9d7c601695148dda6d3f4b709f9366bd4758ad92220f5839c84fcb64e",
     "content/docs/execution-model.mdx": "6f60226d4f90bc92defb14c5b419d707bb3e419baea781f76eb35c68d3c8ef64",
     "content/docs/install.mdx": "82f6b7015c2ddfeba16f53004eb6bbf9e5a5499fe97cbeee9b9244ac72ef694d",
-    "content/docs/install-options.mdx": "f21fc20bde39b80f4c6633c65891c73893e5b088b30dbdaed5611ff09656dc97",
-    "content/docs/configure.mdx": "09adaff6510efdd3e24930f00ffef3e39438a858a91bd1e4fb17b344ce709ce2",
+    "content/docs/install-options.mdx": "3bbfa77af2c34f2b9f203079778b51ee9425624ca516c6392c859ee2add43591",
+    "content/docs/configure.mdx": "a4f96cf774494b104e3b1efe20d24cfef64d9a71284e547e36d93179472eeba7",
     "content/docs/bootstrap-projects-keys.mdx": "477d76731eb09c14b2c1b09582d595258c1a74cc5b193e92644a340db859e6bd",
     "content/docs/quickstart.mdx": "0ae6bbd5c488d39489aa2d83bd100e219b9ebb24b86d8dc1489089c197baa775",
-    "content/docs/public-api.mdx": "b2d7cbf9be5d17e9a1a05ddf2f984adad5c14e5703e16e0165619850d6d82131",
+    "content/docs/public-api.mdx": "7902c5b44fdec1c097b4809634a70c554392cb58cc71fd68d6825b707888281e",
     "content/docs/agents-and-tools.mdx": "9ffa5a5883847f2e4d3641bfd5975baf448fd371542797fd93204f69ea6df5e2",
     "content/docs/sessions.mdx": "b0e127550c76b26d7649503dcf956044f4236eb798430b1000e356b103b02f1c",
     "content/docs/environments-and-files.mdx": "2b8a0e0783032ac7e187361cab2225e9fed524f0ae9bacd3edf43804356cd389",
@@ -46,7 +46,7 @@
     "content/docs/self-hosted-native.mdx": "7697ea6535e56a4efbe31cf77bb7df5c0739dc0216eab53e83b5babf90ac1902",
     "public/images/source/apps/web/public/onboarding/monitor-en.webp": "29dc220cb1250c7016b7c4bf7f30e9510b07c07b814a48c3aa9303b2d76f20b2",
     "content/docs/console.mdx": "356769e6017dbb78a9f42ee04d2d50c4bea6fa366a1bf69a062c04e549d63e0f",
-    "content/docs/admin-api.mdx": "d4da5f91b4df53f1ad57e7b71a986a2efc794756a92b76402aff96f480b8a47e",
+    "content/docs/admin-api.mdx": "d553f7712b22e2eb46bf7c84c2b7a1d67df51996e1533aca2451d24c2caf7628",
     "content/docs/observability.mdx": "595ab9f9918d04c058b64fa3a31d81913bbcbbc4d03138dca63a590979dde112",
     "content/docs/troubleshooting.mdx": "6447708d4d73f9b7793b00215ddcd000ba411c41606db8987c4d848a64b1cd87",
     "content/docs/user-guide.mdx": "97194cf016c237f604b7e626297790dc0ea8b570d4e1a866f7395f2813e0e607",

apps/docs/openapi/core-api.yaml

@@ -3629,6 +3629,93 @@ paths:
               $ref: '#/components/schemas/store.SandboxResetRequest'
         description: Reset mode and current deployment generation
         required: true
+  /core/v1/sandbox/e2b/templates:
+    post:
+      description: Core key only. Uses a transient E2B credential and endpoint through the pinned SDK helper; returns safe template metadata. Does not save the credential or allocate compute.
+      responses:
+        '200':
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.SandboxE2BDiscoveryResult'
+        '400':
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.CoreErrorResponse'
+        '401':
+          description: Unauthorized
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.CoreErrorResponse'
+        '503':
+          description: Service Unavailable
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.CoreErrorResponse'
+      security:
+        - DeploymentAdminAuth: []
+      summary: List templates visible to an E2B credential
+      tags:
+        - Sandbox Manager
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/api.SandboxE2BDiscoveryInput'
+        description: Transient E2B connection
+        required: true
+  /core/v1/sandbox/e2b/templates/{template_id}/builds:
+    post:
+      description: Core key only. Reads one template through the pinned SDK helper with a transient E2B credential. Returns ready builds only, without allocating compute.
+      parameters:
+        - schema:
+            type: string
+          description: Template ID
+          in: path
+          name: template_id
+          required: true
+      responses:
+        '200':
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.SandboxE2BDiscoveryResult'
+        '400':
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.CoreErrorResponse'
+        '401':
+          description: Unauthorized
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.CoreErrorResponse'
+        '503':
+          description: Service Unavailable
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/api.CoreErrorResponse'
+      security:
+        - DeploymentAdminAuth: []
+      summary: List ready builds for an E2B template
+      tags:
+        - Sandbox Manager
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/api.SandboxE2BDiscoveryInput'
+        description: Transient E2B connection
+        required: true
   /core/v1/sandbox/enrollment-tokens:
     post:
       description: Core key only. Does not grant project resource access. Responses contain only explicit safe fields.
@@ -4718,10 +4805,34 @@ components:
       required:
         - expected_generation
       type: object
+    api.SandboxE2BDiscoveryInput:
+      properties:
+        api_key:
+          type: string
+        api_url:
+          type: string
+        domain:
+          type: string
+      type: object
+    api.SandboxE2BDiscoveryResult:
+      properties:
+        builds:
+          items:
+            $ref: '#/components/schemas/e2b.ReadyBuild'
+          type: array
+        templates:
+          items:
+            $ref: '#/components/schemas/e2b.TemplateSummary'
+          type: array
+      type: object
     api.SandboxE2BInput:
       properties:
         api_key:
           type: string
+        api_url:
+          type: string
+        domain:
+          type: string
         template:
           type: string
       type: object
@@ -5073,6 +5184,24 @@ components:
         service:
           $ref: '#/components/schemas/coremetrics.ServiceState'
       type: object
+    e2b.ReadyBuild:
+      properties:
+        cpus:
+          type: integer
+        id:
+          type: string
+        memory_mib:
+          type: integer
+      type: object
+    e2b.TemplateSummary:
+      properties:
+        id:
+          type: string
+        names:
+          items:
+            type: string
+          type: array
+      type: object
     sandbox.DeploymentSpec:
       properties:
         resources:
@@ -5568,8 +5697,12 @@ components:
       type: object
     store.SandboxE2BView:
       properties:
+        api_url:
+          type: string
         credential_configured:
           type: boolean
+        domain:
+          type: string
         template:
           type: string
         template_build:

apps/docs/openapi/sources.json

@@ -1,7 +1,7 @@
 {
   "sources": {
     "contracts/agents-api/openapi.yaml": "b706abf259542b7b9a833b566f20048412d3cbc27c4c4284ed6baf5edc605489",
-    "contracts/agents-api/core.openapi.yaml": "3074ec8de0e313ec116487e96f6b27ac1aa1597f95db4bb162c73ce4d1c184e2",
+    "contracts/agents-api/core.openapi.yaml": "03275522b804b9ac467e0703b5f45c128f4f5cbf13d766387fe85fa1e0592223",
     "contracts/agents-api/runtime.openapi.yaml": "505286d5eacf94a14f9527fcf4e7beb4fba4f792681be26ba966254cbf49b4aa"
   },
   "outputs": {
@@ -40,8 +40,8 @@
     "content/docs/api-reference/core/skills.mdx": "ed899ade7b032b1732b3097d81419a8fdbb9ead0594fca9f2107da644b97031f",
     "content/docs/api-reference/core/vaults.mdx": "12d0aac96cd4a3472ef4eaa287f7945f78862017956e79bfc3ed0ef8e772e78a",
     "content/docs/api-reference/core/credentials.mdx": "27d586b9a8fd738b9947802f32c80458195370252886bc26abedccf2125ee981",
-    "content/docs/api-reference/core/sandbox-manager.mdx": "6be7c52e057365949f0247c18c710561d680847a955f78f1bbe57825d4d5f549",
-    "openapi/core-api.yaml": "a3eb0ad9a86144576ed625a9dc1abcba924c00c7b081bf193cfdf1ea5b58f68a",
+    "content/docs/api-reference/core/sandbox-manager.mdx": "45e65afffb25e5b6ee2ab0853d7a84dee164e0d44ea384675fbd7ffcbd6c1a58",
+    "openapi/core-api.yaml": "7f8e51e6b8373ae33e3069a78745ec9cfeb6dfa415e02a26db6a9feab99b668e",
     "content/docs/api-reference/core/meta.json": "d0aef1f54c4cfc30b4e1d974119ae1cdce1c87d5ecba723afbeb4599119482a7",
     "content/docs/api-reference/core/index.mdx": "57cf9ea947ef45e79575c25a0a3d4e5e856dde6d14698ccc2c51b86201c249e9",
     "content/docs/api-reference/machine/native-installation.mdx": "421a858685b79fdcf8d7eff308c5768d1b62385c3988c6089f380afe80aaed69",

apps/web/e2e/console.ts

@@ -33,6 +33,13 @@ export async function openConsole(page: Page, request: APIRequestContext, hash =
   await page.goto(`/#${hash}`);
 }
 
+/** Selects the ready build returned by the E2B discovery fixture. */
+export async function selectFixtureE2BBuild(page: Page) {
+  await page.getByLabel("E2B API key").fill("fixture-private-key");
+  await page.getByLabel("Template", { exact: true }).selectOption("template");
+  await page.getByLabel("Template build").selectOption("template:94be54a1-138c-4f30-bc87-b13686272dbe");
+}
+
 /** Makes the next matching write fail once with the given status. */
 export async function failNext(request: APIRequestContext, failure: { method: string; path: string; status: number; code?: string; message?: string }) {
   await request.post(`${fixture}/__fixture/fail-next`, { data: failure });