feat: agent sandbox support

.agents/skills/kagent

@@ -0,0 +1 @@
+../../.claude/skills/kagent

.agents/skills/kagent-dev

@@ -0,0 +1 @@
+../../.claude/skills/kagent-dev

.github/workflows/ci.yaml

@@ -15,6 +15,7 @@ env:
   # Cache key components for better organization
   CACHE_KEY_PREFIX: kagent-v2
   BRANCH_CACHE_KEY: ${{ github.head_ref || github.ref_name }}
+  AGENT_SANDBOX_VERSION: v0.3.10
   # Consistent builder configuration
   BUILDX_BUILDER_NAME: kagent-builder-v0.23.0
   BUILDX_VERSION: v0.23.0
@@ -66,6 +67,17 @@ jobs:
         with:
           install_only: true
 
+      - name: Create Kind cluster
+        run: |
+          make create-kind-cluster
+
+      - name: Install agent-sandbox
+        run: |
+          kubectl apply -f "https://github.com/kubernetes-sigs/agent-sandbox/releases/download/${AGENT_SANDBOX_VERSION}/manifest.yaml"
+          kubectl wait --for=condition=Established crd/sandboxes.agents.x-k8s.io --timeout=90s
+          kubectl rollout status deployment/agent-sandbox-controller -n agent-sandbox-system --timeout=120s
+          kubectl wait --for=condition=Ready pod -l app=agent-sandbox-controller -n agent-sandbox-system --timeout=120s
+
       - name: Install Kagent
         id: install-kagent
         env:
@@ -79,10 +91,11 @@ jobs:
             --platform=linux/amd64
             --push
         run: |
-          make create-kind-cluster
           echo "Cache key: ${{ needs.setup.outputs.cache-key }}"
           make helm-install
           make push-test-agent push-test-skill
+          kubectl rollout status deployment/kagent-controller -n kagent --timeout=120s
+          kubectl wait --for=condition=Ready pod -l app.kubernetes.io/component=controller -n kagent --timeout=120s
           kubectl wait --for=condition=Ready  agents.kagent.dev -n kagent --all --timeout=60s || kubectl get po -n kagent -o wide ||:
           kubectl wait --for=condition=Ready  agents.kagent.dev -n kagent --all --timeout=60s
 
@@ -113,15 +126,15 @@ jobs:
         run: |
           # Upgrade helm to use namespace-scoped RBAC
           make helm-install-provider
-          
+
           # Wait for controller to be ready after upgrade
           kubectl rollout status deployment/kagent-controller -n kagent --timeout=90s
-          
+
           # Setup environment variables (reusing logic from previous step)
           HOST_IP=$(docker network inspect kind -f '{{range .IPAM.Config}}{{if .Gateway}}{{.Gateway}}{{"\n"}}{{end}}{{end}}' | grep -E '^[0-9]+\.' | head -1)
           export KAGENT_LOCAL_HOST=$HOST_IP
           export KAGENT_URL="http://$(kubectl get svc -n kagent kagent-controller -o jsonpath='{.status.loadBalancer.ingress[0].ip}'):8083"
-          
+
           # Run critical tests with namespace-scoped RBAC to verify the controller didn't lose needed permissions
           cd go
           go test -v github.com/kagent-dev/kagent/go/core/test/e2e -run '^TestE2EInvokeInlineAgent$|^TestE2EInvokeDeclarativeAgentWithMcpServerTool$' -failfast
@@ -131,6 +144,10 @@ jobs:
           echo "::error::Failed to run e2e tests"
           echo "::error::Kubectl get pods -n kagent"
           kubectl describe pods -n kagent
+          echo "::error::Kubectl get pods -n agent-sandbox-system"
+          kubectl get pods -n agent-sandbox-system -o wide || true
+          echo "::error::Kubectl logs -n agent-sandbox-system deployment/agent-sandbox-controller"
+          kubectl logs -n agent-sandbox-system deployment/agent-sandbox-controller || true
           echo "::error::Kubectl get events -n kagent"
           kubectl get events -n kagent
           echo "::error::Kubectl get agents -n kagent"

go/api/database/client.go

@@ -51,6 +51,7 @@ type Client interface {
 	ListTasksForSession(ctx context.Context, sessionID string) ([]*protocol.Task, error)
 	ListSessions(ctx context.Context, userID string) ([]Session, error)
 	ListSessionsForAgent(ctx context.Context, agentID string, userID string) ([]Session, error)
+	ListSessionsForAgentAllUsers(ctx context.Context, agentID string) ([]Session, error)
 	ListAgents(ctx context.Context) ([]Agent, error)
 	ListToolServers(ctx context.Context) ([]ToolServer, error)
 	ListToolsForServer(ctx context.Context, serverName string, groupKind string) ([]Tool, error)

go/api/database/models.go

@@ -5,6 +5,7 @@ import (
 	"time"
 
 	"github.com/kagent-dev/kagent/go/api/adk"
+	"github.com/kagent-dev/kagent/go/api/v1alpha2"
 	"github.com/pgvector/pgvector-go"
 	"trpc.group/trpc-go/trpc-a2a-go/protocol"
 )
@@ -15,8 +16,9 @@ type Agent struct {
 	UpdatedAt time.Time  `json:"updated_at"`
 	DeletedAt *time.Time `json:"deleted_at,omitempty"`
 
-	Type   string           `json:"type"`
-	Config *adk.AgentConfig `json:"config"`
+	Type         string                `json:"type"`
+	WorkloadType v1alpha2.WorkloadMode `json:"workload_type"`
+	Config       *adk.AgentConfig      `json:"config"`
 }
 
 type Event struct {

go/api/httpapi/types.go

@@ -4,6 +4,7 @@ import (
 	"github.com/kagent-dev/kagent/go/api/database"
 	"github.com/kagent-dev/kagent/go/api/v1alpha1"
 	"github.com/kagent-dev/kagent/go/api/v1alpha2"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 )
 
 // Common types
@@ -83,9 +84,68 @@ type UpdateModelConfigRequest struct {
 
 // Agent types
 
+type AgentResource struct {
+	APIVersion string               `json:"apiVersion,omitempty"`
+	Kind       string               `json:"kind,omitempty"`
+	Metadata   metav1.ObjectMeta    `json:"metadata,omitempty"`
+	Spec       v1alpha2.AgentSpec   `json:"spec,omitempty"`
+	Status     v1alpha2.AgentStatus `json:"status,omitempty"`
+}
+
+func AgentResourceFrom(agent v1alpha2.AgentObject) *AgentResource {
+	if agent == nil {
+		return nil
+	}
+
+	spec := agent.GetAgentSpec()
+	status := agent.GetAgentStatus()
+	gvk := agent.GetObjectKind().GroupVersionKind()
+	apiVersion := gvk.GroupVersion().String()
+	kind := gvk.Kind
+	var metadata metav1.ObjectMeta
+	if apiVersion == "" {
+		apiVersion = v1alpha2.GroupVersion.String()
+	}
+	if kind == "" {
+		if agent.GetWorkloadMode() == v1alpha2.WorkloadModeSandbox {
+			kind = "SandboxAgent"
+		} else {
+			kind = "Agent"
+		}
+	}
+	switch typed := agent.(type) {
+	case *v1alpha2.Agent:
+		metadata = *typed.ObjectMeta.DeepCopy()
+	case *v1alpha2.SandboxAgent:
+		metadata = *typed.ObjectMeta.DeepCopy()
+	default:
+		metadata = metav1.ObjectMeta{
+			Name:            agent.GetName(),
+			Namespace:       agent.GetNamespace(),
+			Labels:          agent.GetLabels(),
+			Annotations:     agent.GetAnnotations(),
+			ResourceVersion: agent.GetResourceVersion(),
+			Generation:      agent.GetGeneration(),
+		}
+	}
+
+	res := &AgentResource{
+		APIVersion: apiVersion,
+		Kind:       kind,
+		Metadata:   metadata,
+	}
+	if spec != nil {
+		res.Spec = *spec.DeepCopy()
+	}
+	if status != nil {
+		res.Status = *status.DeepCopy()
+	}
+	return res
+}
+
 type AgentResponse struct {
-	ID    string          `json:"id"`
-	Agent *v1alpha2.Agent `json:"agent"`
+	ID    string         `json:"id"`
+	Agent *AgentResource `json:"agent"`
 	// Config         *adk.AgentConfig       `json:"config"`
 	ModelProvider   v1alpha2.ModelProvider `json:"modelProvider"`
 	Model           string                 `json:"model"`
@@ -94,6 +154,7 @@ type AgentResponse struct {
 	Tools           []*v1alpha2.Tool       `json:"tools"`
 	DeploymentReady bool                   `json:"deploymentReady"`
 	Accepted        bool                   `json:"accepted"`
+	WorkloadMode    v1alpha2.WorkloadMode  `json:"workloadMode,omitempty"`
 }
 
 // Session types

go/api/v1alpha2/agentobject.go

@@ -0,0 +1,56 @@
+package v1alpha2
+
+import "sigs.k8s.io/controller-runtime/pkg/client"
+
+type WorkloadMode string
+
+const (
+	WorkloadModeDeployment WorkloadMode = "deployment"
+	WorkloadModeSandbox    WorkloadMode = "sandbox"
+)
+
+// AgentObject is the shared shape implemented by agent-style CRDs that expose the
+// same Spec/Status model but reconcile to different workload types.
+// +kubebuilder:object:generate=false
+type AgentObject interface {
+	client.Object
+	GetAgentSpec() *AgentSpec
+	GetAgentStatus() *AgentStatus
+	GetWorkloadMode() WorkloadMode
+}
+
+func (a *Agent) GetAgentSpec() *AgentSpec {
+	if a == nil {
+		return nil
+	}
+	return &a.Spec
+}
+
+func (a *Agent) GetAgentStatus() *AgentStatus {
+	if a == nil {
+		return nil
+	}
+	return &a.Status
+}
+
+func (a *Agent) GetWorkloadMode() WorkloadMode {
+	return WorkloadModeDeployment
+}
+
+func (a *SandboxAgent) GetAgentSpec() *AgentSpec {
+	if a == nil {
+		return nil
+	}
+	return &a.Spec
+}
+
+func (a *SandboxAgent) GetAgentStatus() *AgentStatus {
+	if a == nil {
+		return nil
+	}
+	return &a.Status
+}
+
+func (a *SandboxAgent) GetWorkloadMode() WorkloadMode {
+	return WorkloadModeSandbox
+}

go/api/v1alpha2/sandboxagent_types.go

@@ -0,0 +1,47 @@
+/*
+Copyright 2025.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1alpha2
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// +kubebuilder:object:root=true
+// +kubebuilder:subresource:status
+// +kubebuilder:printcolumn:name="Ready",type="string",JSONPath=".status.conditions[?(@.type=='Ready')].status",description="Whether the sandbox workload is ready."
+// +kubebuilder:printcolumn:name="Accepted",type="string",JSONPath=".status.conditions[?(@.type=='Accepted')].status",description="Whether configuration was accepted."
+// SandboxAgent declares an agent that runs in an isolated sandbox (agent-sandbox Sandbox CR).
+type SandboxAgent struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	Spec   AgentSpec   `json:"spec,omitempty"`
+	Status AgentStatus `json:"status,omitempty"`
+}
+
+// +kubebuilder:object:root=true
+
+// SandboxAgentList contains a list of SandboxAgent.
+type SandboxAgentList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+	Items           []SandboxAgent `json:"items"`
+}
+
+func init() {
+	SchemeBuilder.Register(&SandboxAgent{}, &SandboxAgentList{})
+}

go/core/cli/internal/cli/agent/get.go

@@ -109,8 +109,8 @@ func printAgents(agents []api.AgentResponse) error {
 	for i, agent := range agents {
 		rows[i] = []string{
 			strconv.Itoa(i + 1),
-			utils.GetObjectRef(agent.Agent),
-			agent.Agent.CreationTimestamp.Format(time.RFC3339),
+			utils.ResourceRefString(agent.Agent.Metadata.Namespace, agent.Agent.Metadata.Name),
+			agent.Agent.Metadata.CreationTimestamp.Format(time.RFC3339),
 			strconv.FormatBool(agent.DeploymentReady),
 			strconv.FormatBool(agent.Accepted),
 		}