feat(craft): sandbox outputs manifest (#14325)

Author: nmgarza5

backend/onyx/server/features/build/sandbox/base.py

@@ -32,6 +32,9 @@
     ToolCallProgress,
     ToolCallStart,
 )
+from onyx.server.features.build.sandbox.image.sandbox_daemon.contract import (
+    OutputsManifestResponse,
+)
 from onyx.server.features.build.sandbox.models import (
     CraftLLMProviderConfig,
     CraftMCPServerConfig,
@@ -471,6 +474,19 @@ def list_directory(
         """
         ...
 
+    @abstractmethod
+    def get_outputs_manifest(
+        self, sandbox_id: UUID, session_id: UUID
+    ) -> OutputsManifestResponse:
+        """Describe the session's outputs tree in one call.
+
+        Symlinks and non-regular files are counted, never followed. Regular
+        files carry size, mtime, and a content hash when under the hash
+        ceilings. A missing outputs tree is an empty manifest, not an error.
+        Raises RuntimeError-family errors when the backend cannot answer.
+        """
+        ...
+
     @abstractmethod
     def read_file(self, sandbox_id: UUID, session_id: UUID, path: str) -> bytes:
         """Read a file from the session's workspace.

backend/onyx/server/features/build/sandbox/docker/docker_sandbox_manager.py

@@ -112,6 +112,9 @@
     stream_stdin_to_container,
     stream_stdout_from_container,
 )
+from onyx.server.features.build.sandbox.image.sandbox_daemon.contract import (
+    OutputsManifestResponse,
+)
 from onyx.server.features.build.sandbox.labels import (
     LABEL_K8S_MANAGED_BY,
     LABEL_K8S_MANAGED_BY_ONYX,
@@ -1621,6 +1624,32 @@ def list_directory(
         entries = self._parse_ls_output(output, clean_path)
         return sorted(entries, key=lambda e: (not e.is_directory, e.name.lower()))
 
+    def get_outputs_manifest(
+        self, sandbox_id: UUID, session_id: UUID
+    ) -> OutputsManifestResponse:
+        container = self._require_container(sandbox_id)
+        try:
+            # Root-owned interpreter and module: the sandbox user owns
+            # /workspace, so anything under it could be swapped to lie.
+            # workdir=/opt is load-bearing, python -m imports the root-owned
+            # /opt/sandbox_daemon only because cwd leads sys.path. -E -s
+            # ignore PYTHON* env vars and the user site directory.
+            result = _run_in_container_as_sandbox_user(
+                container,
+                [
+                    "/usr/local/bin/python3",
+                    "-E",
+                    "-s",
+                    "-m",
+                    "sandbox_daemon.manifest",
+                    str(session_id),
+                ],
+                workdir="/opt",
+            )
+        except ExecError as e:
+            raise RuntimeError(f"Failed to build outputs manifest: {e}") from e
+        return OutputsManifestResponse.model_validate_json(result.stdout_text)
+
     def _parse_ls_output(self, ls_output: str, base_path: str) -> list[FilesystemEntry]:
         entries: list[FilesystemEntry] = []
         for line in ls_output.strip().split("\n"):

backend/onyx/server/features/build/sandbox/image/Dockerfile

@@ -1,3 +1,4 @@
+# syntax=docker/dockerfile:1-labs
 # Sandbox Container Image
 #
 # User-shared sandbox: one pod per user, sessions created via kubectl exec.
@@ -186,6 +187,15 @@ ENV PATH="/home/sandbox/.opencode/bin:${PATH}"
 ENV OPENCODE_DISABLE_MODELS_FETCH=1
 
 COPY --exclude=__pycache__ sandbox_daemon/ /workspace/sandbox_daemon/
+# Root-owned copy for exec-based backends: the manifest must run code the
+# sandbox user cannot replace. /workspace stays sandbox-owned below. The
+# contract model needs pydantic, so the root-owned system interpreter gets its
+# own copy (version pinned to match initial-requirements.txt): the exec path
+# must share nothing with the sandbox-owned venv.
+COPY --exclude=__pycache__ sandbox_daemon/ /opt/sandbox_daemon/
+RUN /usr/local/bin/python3 -m pip install --no-cache-dir --only-binary=:all: \
+    pydantic==2.13.4 && \
+    rm -rf /root/.cache/pip
 COPY entrypoint.sh /workspace/entrypoint.sh
 COPY sidecar-entrypoint.sh /workspace/sidecar-entrypoint.sh
 

backend/onyx/server/features/build/sandbox/image/sandbox_daemon/contract.py

@@ -15,6 +15,7 @@
 SIDECAR_PUSH_PATH = "/push"
 PUSH_DAEMON_PORT = 8731
 SIDECAR_FILESYSTEM_LIST_PATH = "/filesystem/list"
+SIDECAR_OUTPUTS_MANIFEST_PATH = "/filesystem/outputs-manifest"
 SIDECAR_SNAPSHOT_CREATE_PATH = "/snapshot/create"
 SIDECAR_SNAPSHOT_RESTORE_PREFIX = "/snapshot/restore"
 SIDECAR_SNAPSHOT_RESTORE_ROUTE = f"{SIDECAR_SNAPSHOT_RESTORE_PREFIX}/{{session_id}}"
@@ -34,6 +35,9 @@ class SnapshotCreateRequest(BaseModel):
     session_id: UUID
 
 
+# Restore has no response body. Failures raise, success is the 204.
+
+
 class FilesystemListRequest(BaseModel):
     model_config = ConfigDict(extra="forbid")
 
@@ -57,4 +61,28 @@ class FilesystemListResponse(BaseModel):
     entries: list[SidecarFilesystemEntry]
 
 
-# Restore has no response body — failures raise, success is the 204.
+class OutputsManifestRequest(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+
+    session_id: UUID
+
+
+class OutputsManifestEntry(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+
+    path: str
+    is_directory: bool
+    size: int | None = None
+    mtime_ns: int | None = None
+    # None for directories and for files past the hash ceilings.
+    sha256: str | None = None
+
+
+class OutputsManifestResponse(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+
+    entries: list[OutputsManifestEntry]
+    skipped_symlinks: int = 0
+    skipped_special: int = 0
+    skipped_unreadable: int = 0
+    truncated: bool = False