feat: add POST /api/sandbox endpoint (#155)

* feat: add Google Drive and Google Docs to enabled toolkits (#153) (#154)

* feat: add Google Drive and Google Docs to enabled toolkits

- Add googledrive and googledocs to ENABLED_TOOLKITS array
- Enables Tool Router access to Google Drive and Google Docs tools

* docs: update JSDoc to mention all Google integrations

* feat: add POST /api/sandbox endpoint

Create ephemeral sandbox environments using Vercel Sandbox SDK.
- Add route handler with CORS and API key authentication
- Add createSandbox function using @vercel/sandbox
- Returns sandboxId, status, timeout, createdAt

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* fix: add snapshotting status to SandboxCreatedResponse

The Vercel Sandbox SDK includes "snapshotting" as a valid status.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* refactor: use Sandbox SDK types for SandboxCreatedResponse

DRY - reference types from @vercel/sandbox instead of duplicating.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

---------

Co-authored-by: Sidney Swift <158200036+sidneyswift@users.noreply.github.com>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

Author: 3 people

app/api/sandbox/route.ts

@@ -0,0 +1,38 @@
+import { NextRequest, NextResponse } from "next/server";
+import { getCorsHeaders } from "@/lib/networking/getCorsHeaders";
+import { createSandboxPostHandler } from "@/lib/sandbox/createSandboxPostHandler";
+
+/**
+ * OPTIONS handler for CORS preflight requests.
+ *
+ * @returns A NextResponse with CORS headers.
+ */
+export async function OPTIONS() {
+  return new NextResponse(null, {
+    status: 200,
+    headers: getCorsHeaders(),
+  });
+}
+
+/**
+ * POST /api/sandbox
+ *
+ * Creates a new ephemeral sandbox environment.
+ * Sandboxes are isolated Linux microVMs that can be used to evaluate
+ * account-generated code, run AI agent output safely, or execute reproducible tasks.
+ *
+ * Request:
+ * - No request body required
+ * - Authentication via x-api-key header
+ *
+ * Response:
+ * - 200: { sandboxId: string, status: string, timeout: number, createdAt: string }
+ * - 400: { error: "Failed to create sandbox" }
+ * - 401: { status: "error", error: "x-api-key header required" or "Invalid API key" }
+ *
+ * @param request - The request object
+ * @returns A NextResponse with the created sandbox data or error
+ */
+export async function POST(request: NextRequest) {
+  return createSandboxPostHandler(request);
+}

lib/sandbox/createSandbox.ts

@@ -0,0 +1,29 @@
+import { Sandbox } from "@vercel/sandbox";
+
+/**
+ * Response from creating a sandbox.
+ * Uses Sandbox class types from @vercel/sandbox SDK.
+ */
+export interface SandboxCreatedResponse {
+  sandboxId: Sandbox["sandboxId"];
+  status: Sandbox["status"];
+  timeout: Sandbox["timeout"];
+  createdAt: string;
+}
+
+/**
+ * Creates a new ephemeral sandbox environment using Vercel Sandbox SDK.
+ *
+ * @returns The created sandbox details
+ * @throws Error if sandbox creation fails
+ */
+export async function createSandbox(): Promise<SandboxCreatedResponse> {
+  const sandbox = await Sandbox.create();
+
+  return {
+    sandboxId: sandbox.sandboxId,
+    status: sandbox.status,
+    timeout: sandbox.timeout,
+    createdAt: sandbox.createdAt.toISOString(),
+  };
+}

lib/sandbox/createSandboxPostHandler.ts

@@ -0,0 +1,29 @@
+import { NextRequest, NextResponse } from "next/server";
+import { getCorsHeaders } from "@/lib/networking/getCorsHeaders";
+import { getApiKeyAccountId } from "@/lib/auth/getApiKeyAccountId";
+import { createSandbox } from "@/lib/sandbox/createSandbox";
+
+/**
+ * Handler for POST /api/sandbox.
+ *
+ * Creates a new ephemeral sandbox environment. Requires authentication via x-api-key header.
+ * No request body is required.
+ *
+ * @param request - The request object
+ * @returns A NextResponse with sandbox data or error
+ */
+export async function createSandboxPostHandler(request: NextRequest): Promise<NextResponse> {
+  const accountIdOrError = await getApiKeyAccountId(request);
+  if (accountIdOrError instanceof NextResponse) {
+    return accountIdOrError;
+  }
+
+  try {
+    const sandbox = await createSandbox();
+
+    return NextResponse.json(sandbox, { status: 200, headers: getCorsHeaders() });
+  } catch (error) {
+    const message = error instanceof Error ? error.message : "Failed to create sandbox";
+    return NextResponse.json({ error: message }, { status: 400, headers: getCorsHeaders() });
+  }
+}

package.json

@@ -17,8 +17,6 @@
   },
   "dependencies": {
     "@ai-sdk/anthropic": "^3.0.13",
-    "autoevals": "^0.0.129",
-    "braintrust": "^0.4.9",
     "@ai-sdk/gateway": "^3.0.14",
     "@ai-sdk/google": "^3.0.8",
     "@ai-sdk/mcp": "^0.0.12",
@@ -31,9 +29,12 @@
     "@privy-io/node": "^0.6.2",
     "@supabase/supabase-js": "^2.86.0",
     "@trigger.dev/sdk": "^4.2.0",
+    "@vercel/sandbox": "^1.3.1",
     "ai": "6.0.0-beta.122",
     "apify-client": "^2.20.0",
     "arweave": "^1.15.7",
+    "autoevals": "^0.0.129",
+    "braintrust": "^0.4.9",
     "bullmq": "^5.65.1",
     "googleapis": "^168.0.0",
     "ioredis": "^5.8.2",