Skip to content

Provision the self-hosted sandbox quickstarts with ant apply - #462

Open
cj-ant wants to merge 2 commits into
cj-ant/archil-sandboxesfrom
cj/ant-apply-self-hosted-sandboxes
Open

cj-ant wants to merge 2 commits into
cj-ant/archil-sandboxesfrom
cj/ant-apply-self-hosted-sandboxes

Conversation

@cj-ant

@cj-ant cj-ant commented Sep 4, 2026

Copy link
Copy Markdown
Collaborator

Description

ant apply shipped in ant 1.30.0 (2026-09-03) and its docs page is live: Manage resources as code with ant apply. This starts moving the Managed Agents quickstarts onto it, beginning with the three self-hosted sandbox demos (docker/, docker-memory/, archil/), which all provisioned their resources by piping YAML into ant beta:* create from a hand-written agents/setup.sh.

Stacked on #460 (the archil/ quickstart) so the three demos and their shared README and CLAUDE.md runbook move together. GitHub retargets this to main when #460 merges.

Per demo:

  • agents/<name>.md is the agent: frontmatter is the request body, the prose is the system prompt. environments/self-hosted.yaml is the self-hosted environment, and docker-memory/ adds memory_stores/user-preferences.yaml. Same request bodies as the old YAML. agents/setup.sh and the agents/<name>/ directories are gone.
  • ant apply . creates everything and records the IDs in claude-lock.json. start.sh reads the environment ID from there with jq (an exported ANTHROPIC_ENVIRONMENT_ID still wins, for a sandbox host without the lockfile), archil/fanout.sh reads the agent and environment IDs from there, and the README sessions create commands read them the same way. .env now carries only secrets: the environment key, optionally an API key, archil's credentials.
  • claude-lock.json is gitignored in each demo because every reader applies to their own workspace. The READMEs say to commit it in a real project.
  • The READMEs, the shared README, and the CLAUDE.md runbook describe the apply flow, including ant apply --yes . for Claude Code (no TTY for the confirmation prompt) and the origin-mismatch error. The ant pin in docker/Dockerfile (1.23.0) and archil/sandboxes.py (1.28.0) moves to 1.30.0 so one version covers host and sandbox.

Not in this PR: assistant-ui/, chat-sdk/, copilot-kit-ag-ui/ still provision from TypeScript setup scripts here (and from agents/setup.sh YAML on the private repo's main, which never published). They are the follow-up, same pattern.

Quickstart

  • Computer Use Demo
  • Customer Support Agent
  • Financial Data Analyst
  • N/A (managed-agents/self-hosted-sandboxes: docker, docker-memory, archil)

Type of Change

  • Bug fix
  • New feature
  • Documentation update
  • Code refactoring
  • Other (please describe):

Testing

  • Added/updated unit tests
  • Tested manually
  • Verified in development environment

Against the API with ant 1.30.0 (linux amd64 release binary), in a test org:

  • ant apply --dry-run -v . in each demo: plans 2, 3, and 2 creates with the same bodies the old YAML sent (system, tools, metadata, config: {type: self_hosted}); README.md, scripts, and Dockerfile are skipped by the walk.
  • ant apply --yes . in each demo: all 7 resources created, claude-lock.json written with ./agents/..., ./environments/..., ./memory_stores/... keys. ant beta:agents retrieve on each agent matches the file (archil's 3.8 KB system prompt intact).
  • Edit and reapply on docker-memory/agents/memory-demo.md: plan shows ~ update, agent goes to version 2, lockfile records it. Immediate rerun: Everything is up to date.
  • The README ant beta:sessions create commands for docker/ and docker-memory/ (with --resource {type: memory_store, ...}) run verbatim with the jq-read IDs; the session comes up on agent version 2 with the store attached. archil/fanout.sh "Tesla" creates its session from the lockfile IDs.
  • start.sh in all three resolves the environment from claude-lock.json and stops at the expected next check (set ANTHROPIC_ENVIRONMENT_KEY ... for env_..., or the archil SDK check).
  • Teardown: sessions deleted, then ant apply --prune --yes archived every test resource.

Not run end to end: a worker actually serving a session (needs an environment key minted in the Console), the archil data load, and the docker build with the 1.30.0 pin (the release asset URL pattern is unchanged and beta:worker run keeps --workdir/--max-idle/--log-format in 1.30.0).

Additional Notes

  • One docs discrepancy found while testing: the apply docs page lists a --no-managed-metadata flag and says apply adds managed_by metadata, but 1.30.0 has neither (ant apply --help, and the created agents carry only the file's own metadata). Nothing in this PR depends on it.

🤖 Generated with Claude Code

Requested by CJ · Claude session #01AKwbEz

cj-ant and others added 2 commits September 4, 2026 14:29
The three self-hosted sandbox demos (docker, docker-memory, archil) now
declare their agent, environment, and memory store as files that
`ant apply` reconciles, instead of piping YAML into `ant beta:* create`
from a hand-written agents/setup.sh. `ant apply` shipped in ant 1.30.0
(2026-09-03) and the docs page is public:
https://platform.claude.com/docs/en/cli-sdks-libraries/cli/apply

Per demo:
- agents/<name>.md holds the agent (frontmatter is the request body, the
  prose is the system prompt), environments/self-hosted.yaml the
  self-hosted environment, and in docker-memory/
  memory_stores/user-preferences.yaml the store. Same request bodies as
  the old YAML; agents/setup.sh and the agents/<name>/ directories are gone.
- `ant apply .` creates everything and records the IDs in
  claude-lock.json. start.sh reads the environment ID from there with jq
  (an exported ANTHROPIC_ENVIRONMENT_ID still wins), archil/fanout.sh reads
  the agent and environment IDs from there, and the README session
  commands read them the same way. .env now carries only secrets: the
  environment key, optionally an API key, and archil's credentials.
- claude-lock.json is gitignored here because every reader applies to
  their own workspace; the READMEs say to commit it in a real project.
- READMEs, the shared README, and the CLAUDE.md runbook describe the apply
  flow (including --yes for Claude Code, which has no TTY). The ant pin in
  docker/Dockerfile and archil/sandboxes.py moves to 1.30.0 so one version
  covers host and sandbox.

Verified against the API with ant 1.30.0: applied each demo (2 + 3 + 2
resources created), confirmed the server-side agent bodies match the old
YAML, edited an agent and reapplied (version 2), reran as a no-op, ran the
README `sessions create` commands and fanout.sh with lockfile-read IDs,
checked start.sh resolves the environment from the lockfile, then deleted
the sessions and pruned (archived) every test resource.

Co-Authored-By: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AKwbEzQXeNMu5gXRTxbsag
… ID guards

Three findings from the pre-review pass on the ant apply migration:

- start.sh (all three) and fanout.sh only read the claude-lock.json beside
  them, but `ant apply` run from another directory writes the lockfile
  there and later runs walk up and adopt it. The "no environment ID"
  message now says to run apply from the demo directory so the lockfile
  lands beside the scripts, and the CLAUDE.md debugging table has a row
  for the "ant apply says up to date but start.sh finds nothing" loop.
- docker/ and docker-memory/ are already published with the setup.sh
  flow, whose IDs live in .env. start.sh honors CLAUDE_ENVIRONMENT_ID again
  so a returning user keeps their environment and key instead of applying
  duplicates, and CLAUDE.md says what their options are.
- fanout.sh reads IDs with `// empty` and a `:?` guard, so a partially
  applied lockfile fails with "run ant apply again" instead of sending the
  literal string null as an agent ID.

Co-Authored-By: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AKwbEzQXeNMu5gXRTxbsag
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant