Pimp My IDE / garage dispatchBack to the garage
October 8, 2026 / sandbox lifecycle / field note

A slot name is not a machine.

When a sandbox name can be reused, cleanup needs the machine's generation too. Otherwise a delayed stop command can hit somebody else's fresh container.

Address the incarnation. Reject stale cleanup.

Cleanup can arrive after the machine is gone.

Mainbrella published a sandbox adapter for the Deep Agents harness. The implementation lives in a fork while an upstream feature request remains open. Its useful idea is smaller than the full integration. A sandbox ID contains both a reusable slot and the container's creation time.[1][2]

The adapter returns IDs such as small@2026-10-08T09:25:17.059Z. It rejects a bare slot name. Before attach or delete, it checks that both the slot and creation time still name a running container. A cleanup request for an old generation cannot silently attach to the replacement.[2]

The handle used to start work must still identify the same machine when work stops.

This is a lifecycle contract.

Deep Agents separates graph state from the filesystem and shell backend. Its architecture document says LangGraph owns conversation state and checkpoints. The backend decides where files and command execution live. A checkpoint can remember that a report existed after the sandbox disk has disappeared.[3]

The official sandbox guide adds the operating cost. Sandboxes consume resources until shutdown. Applications need an explicit scope, mapping, time to live, and cleanup path. Its examples create a sandbox before agent work and stop it in a finally block.[4]

That means the receipt needs two clocks. The agent run has a thread or checkpoint lifetime. The machine has a creation time and deletion result. Do not infer one from the other.

Retries split at the side-effect boundary.

The Mainbrella adapter accepts an idempotency key when creating a machine. If the reply disappears after creation, a retry can reconcile the original request instead of starting another container. The adapter does not apply the same rule to shell commands or file writes. Repeating those operations could repeat their side effects.[1][2]

Record which call can be replayed. Creation may have a stable key. Attach should require an exact generation. Command execution needs its own operation-level idempotency or a fresh observation before retry. Cleanup should report that the addressed generation stopped or was already absent.

The integration is real, but not upstream.

The forked commit adds the langchain-mainbrella package, provider code, tests, and dcode --sandbox mainbrella wiring. The upstream issue was open and awaiting triage when read. This is a working vendor implementation and proposal, not a released Deep Agents provider in the upstream repository.[2]

The vendor reports eight backend tests and eight command-line integration tests against its local service. Those results support the stated integration paths. They do not prove model task quality, comparative reliability, or production fitness.[1]

Keep the machine receipt short.

SLOT=small
GENERATION=2026-10-08T09:25:17.059Z
CREATE_KEY=[REQUIRED]
THREAD_ID=[REQUIRED]
CHECKPOINT_ID=[REQUIRED]
OUTPUT_EXPORTED=[YES / NO]
STOP_TARGET=small@2026-10-08T09:25:17.059Z
STOP_RESULT=[REQUIRED]
REPLACEMENT_GENERATION=[NONE / ID]

Store the full machine ID. Save durable output before stop. Keep the stop result beside the generation it addressed. If a new machine inherits the slot, the old receipt should fail closed.

Interactive makeover / machine generation interlock

Test the stale cleanup route.

This replaces a generic stop button with a lifecycle simulator. Reuse the slot, then send the old cleanup request. The gate compares the full machine ID before it touches the current container.

Create generationIssue cleanupReuse slotCompare and stop

Slot history

The simulator starts with generation A running. Issue its cleanup request, then reuse the slot as generation B.

Generation Asmall@09:25:17.059ZRunning
Generation Bsmall@10:04:42.811ZNot created

Identity gate

No cleanup request has been issued.

Requested targetNONE
Current targetsmall@09:25:17.059Z
Waiting for a request.

Issue generation A's cleanup request to begin.

Sources read / October 8, 2026

Source log

Open the evidence boundary
  1. Mainbrella Engineering, "New batteries for the batteries-included agent harness", read October 8, 2026. The vendor describes its Deep Agents adapter, generation-qualified IDs, creation reconciliation, command-result semantics, file limits, local test results, and the open upstream status.
  2. Mainbrella Deep Agents fork at commit 142d3a9, inspected October 8, 2026. We read the package README and provider implementation. The code rejects bare slot IDs and checks slot, creation time, and running state before attach or delete. The related upstream issue 6856 was open and labeled for triage when checked.
  3. Deep Agents architecture, read October 8, 2026. The upstream document separates LangGraph state and checkpoints from backend-owned filesystem, memory, and shell execution.
  4. LangChain Deep Agents sandbox documentation, read October 8, 2026. It documents provider backends, explicit creation and cleanup examples, thread and assistant scoping, time-to-live behavior, and the cost of running sandboxes.
  5. Hacker News item 50003860, checked against the official HN API on October 8, 2026. It led to the Mainbrella article. The discussion had no substantive comments when read.

Evidence boundary: we inspected the published article, exact fork commit, upstream issue, and first-party Deep Agents documentation. We did not install the fork, provision a Mainbrella container, replay the reported tests, or compare sandbox providers. The interactive interlock uses synthetic IDs and local browser state. It demonstrates the identity rule. It does not control a real machine.