diff --git a/docs/sandbox/clients.md b/docs/sandbox/clients.md index bd21da63d3..6c7fcf035e 100644 --- a/docs/sandbox/clients.md +++ b/docs/sandbox/clients.md @@ -113,7 +113,7 @@ Hosted sandbox clients expose provider-specific mount strategies. Choose the bac | `DaytonaSandboxClient` | Supports rclone-backed cloud storage mounts with `DaytonaCloudBucketMountStrategy`; use it with `S3Mount`, `GCSMount`, `R2Mount`, `AzureBlobMount`, and `BoxMount`. | | `E2BSandboxClient` | Supports rclone-backed cloud storage mounts with `E2BCloudBucketMountStrategy`; use it with `S3Mount`, `GCSMount`, `R2Mount`, `AzureBlobMount`, and `BoxMount`. | | `RunloopSandboxClient` | Supports rclone-backed cloud storage mounts with `RunloopCloudBucketMountStrategy`; use it with `S3Mount`, `GCSMount`, `R2Mount`, `AzureBlobMount`, and `BoxMount`. | -| `VercelSandboxClient` | No hosted-specific mount strategy is currently exposed. Use manifest files, repos, or other workspace inputs instead. | +| `VercelSandboxClient` | Supports create-time `S3Mount` entries through `VercelCloudBucketMountStrategy`. | @@ -130,8 +130,50 @@ The table below summarizes which remote storage entries each backend can mount d | `DaytonaSandboxClient` | ✓ | ✓ | ✓ | ✓ | ✓ | - | | `E2BSandboxClient` | ✓ | ✓ | ✓ | ✓ | ✓ | - | | `RunloopSandboxClient` | ✓ | ✓ | ✓ | ✓ | ✓ | - | -| `VercelSandboxClient` | - | - | - | - | - | - | +| `VercelSandboxClient` | ✓ | - | - | - | - | - | +### Vercel S3 mounts + +Vercel supports create-time `S3Mount` entries through +`VercelCloudBucketMountStrategy`. Declare the mount in the manifest passed to +`VercelSandboxClient.create`. The mount topology is fixed for the lifetime of +the sandbox session. + +```python +import os + +from agents.extensions.sandbox.vercel import ( + VercelCloudBucketMountStrategy, + VercelSandboxClient, + VercelSandboxClientOptions, +) +from agents.sandbox import Manifest +from agents.sandbox.entries import S3Mount + +manifest = Manifest( + root="/workspace", + entries={ + "data": S3Mount( + bucket="my-data-bucket", + region="us-east-1", + access_key_id=os.environ["AWS_ACCESS_KEY_ID"], + secret_access_key=os.environ["AWS_SECRET_ACCESS_KEY"], + ephemeral=True, + mount_strategy=VercelCloudBucketMountStrategy(), + ) + }, +) + +session = await VercelSandboxClient().create( + manifest=manifest, + options=VercelSandboxClientOptions(allow_s3_credential_exposure=True), +) +``` + +- Inline credentials are exposed to code running in the sandbox. Set `allow_s3_credential_exposure=True` only for credentials scoped to that sandbox and bucket. +- Credentials are removed from serialized session state. Sessions containing Vercel S3 mounts cannot be resumed; create a new sandbox from a trusted manifest instead. +- Workspace persistence temporarily unmounts S3 buckets, so persisted workspace data excludes remote bucket contents. Native snapshot hydration is not supported while S3 mounts are active. + For more runnable examples, browse [examples/sandbox/](https://github.com/openai/openai-agents-python/tree/main/examples/sandbox) for local, coding, memory, handoff, and agent-composition patterns, and [examples/sandbox/extensions/](https://github.com/openai/openai-agents-python/tree/main/examples/sandbox/extensions) for hosted sandbox clients.