improvement(sandbox): select the provider by SANDBOX_PROVIDER env var

Replaces the boolean sandbox-provider-daytona feature flag with a
SANDBOX_PROVIDER env var naming the provider ('e2b' default, or 'daytona').
A boolean doesn't scale to a third adapter; a keyed registry does.

- PROVIDERS is a Record<SandboxProviderId, SandboxProvider>, so adding an
  adapter is one entry plus one id-union member — an unhandled provider is a
  compile error, not a runtime surprise
- resolveProvider() reads env synchronously and throws on an unknown value
  (fail fast) instead of an async feature-flag lookup
- drops the sandbox-provider-daytona flag and SANDBOX_PROVIDER_DAYTONA fallback

Verified end-to-end: a Python function block through the running app routes to
Daytona (Creating Daytona sandbox, kind: code) with SANDBOX_PROVIDER=daytona.

Author: TheodoreSpeaks

apps/sim/lib/core/config/env.ts

@@ -454,12 +454,14 @@ export const env = createEnv({
     MOTHERSHIP_E2B_DOC_TEMPLATE_ID:         z.string().optional(),                  // Dedicated E2B template with python-pptx/docx/openpyxl/reportlab for document generation; when set (and E2B enabled), docs compile via Python instead of the JS isolated-vm path
     E2B_PI_TEMPLATE_ID:                     z.string().optional(),                  // E2B template ID/alias with the Pi CLI + git baked in (Create PR and Review Code)
 
-    // Daytona Remote Code Execution (manual failover for E2B; selected by the sandbox-provider-daytona flag)
+    // Remote Code Execution provider selection
+    SANDBOX_PROVIDER:                      z.string().optional(),                  // Which sandbox provider serves remote executions: 'e2b' (default) or 'daytona'
+
+    // Daytona Remote Code Execution (used when SANDBOX_PROVIDER=daytona)
     DAYTONA_API_KEY:                       z.string().optional(),                  // Daytona API key; needs write:snapshots to build images, write:sandboxes to run them
     DAYTONA_SHELL_SNAPSHOT_ID:             z.string().optional(),                  // Daytona snapshot mirroring mothership-shell (must carry an explicit tag; latest is rejected)
     DAYTONA_DOC_SNAPSHOT_ID:               z.string().optional(),                  // Daytona snapshot mirroring mothership-docs
     DAYTONA_PI_SNAPSHOT_ID:                z.string().optional(),                  // Daytona snapshot mirroring the Pi template (Create PR and Review Code)
-    SANDBOX_PROVIDER_DAYTONA:              z.string().optional(),                  // Fallback for the sandbox-provider-daytona flag when AppConfig is not the source of truth
 
     // Access Control (Permission Groups) - for self-hosted deployments
     ACCESS_CONTROL_ENABLED:                z.boolean().optional(),                 // Enable access control on self-hosted (bypasses plan requirements)

apps/sim/lib/core/config/feature-flags.ts

@@ -105,16 +105,6 @@ const FEATURE_FLAGS = {
       'self-hosted/local behaviour. Fallback mirrors FORKING_ENABLED for off-AppConfig reads.',
     fallback: 'FORKING_ENABLED',
   },
-  'sandbox-provider-daytona': {
-    description:
-      'Route remote sandbox execution (function blocks, shell, doc generation, Pi cloud agent) to ' +
-      'Daytona instead of E2B — the manual failover for an E2B outage. Global on/off only: ' +
-      'resolved without user/org context at every sandbox entry point so the whole deployment ' +
-      'switches together, and resolved ONCE before the sandbox is created so a run is never ' +
-      'migrated mid-execution (user code has side effects). Requires the DAYTONA_* snapshot ids; ' +
-      'each sandbox kind fails closed when its snapshot is unset.',
-    fallback: 'SANDBOX_PROVIDER_DAYTONA',
-  },
   'deploy-as-block': {
     description:
       'Publish a deployed workflow as a reusable, org-wide custom block (custom name/SVG icon/' +

apps/sim/lib/execution/remote-sandbox/conformance.test.ts

@@ -10,7 +10,7 @@ import { beforeEach, describe, expect, it, vi } from 'vitest'
 import { CodeLanguage } from '@/lib/execution/languages'
 
 const {
-  mockIsFeatureEnabled,
+  mockEnv,
   mockE2BCreate,
   mockE2BRunCode,
   mockE2BCommandsRun,
@@ -25,7 +25,17 @@ const {
   mockDownloadFile,
   mockDelete,
 } = vi.hoisted(() => ({
-  mockIsFeatureEnabled: vi.fn(),
+  mockEnv: {
+    SANDBOX_PROVIDER: 'e2b' as string | undefined,
+    E2B_API_KEY: 'test-key',
+    MOTHERSHIP_E2B_TEMPLATE_ID: 'mothership-shell',
+    MOTHERSHIP_E2B_DOC_TEMPLATE_ID: 'mothership-docs',
+    E2B_PI_TEMPLATE_ID: 'sim-pi',
+    DAYTONA_API_KEY: 'test-key',
+    DAYTONA_SHELL_SNAPSHOT_ID: 'mothership-shell:v1' as string | undefined,
+    DAYTONA_DOC_SNAPSHOT_ID: 'mothership-docs:v1' as string | undefined,
+    DAYTONA_PI_SNAPSHOT_ID: 'sim-pi:v1' as string | undefined,
+  },
   mockE2BCreate: vi.fn(),
   mockE2BRunCode: vi.fn(),
   mockE2BCommandsRun: vi.fn(),
@@ -47,19 +57,7 @@ vi.mock('@daytonaio/sdk', () => ({
     create = mockDaytonaCreate
   },
 }))
-vi.mock('@/lib/core/config/env', () => ({
-  env: {
-    E2B_API_KEY: 'test-key',
-    MOTHERSHIP_E2B_TEMPLATE_ID: 'mothership-shell',
-    MOTHERSHIP_E2B_DOC_TEMPLATE_ID: 'mothership-docs',
-    E2B_PI_TEMPLATE_ID: 'sim-pi',
-    DAYTONA_API_KEY: 'test-key',
-    DAYTONA_SHELL_SNAPSHOT_ID: 'mothership-shell:v1',
-    DAYTONA_DOC_SNAPSHOT_ID: 'mothership-docs:v1',
-    DAYTONA_PI_SNAPSHOT_ID: 'sim-pi:v1',
-  },
-}))
-vi.mock('@/lib/core/config/feature-flags', () => ({ isFeatureEnabled: mockIsFeatureEnabled }))
+vi.mock('@/lib/core/config/env', () => ({ env: mockEnv }))
 
 import {
   executeInSandbox,
@@ -70,9 +68,9 @@ import {
 type Provider = 'e2b' | 'daytona'
 const PROVIDERS: Provider[] = ['e2b', 'daytona']
 
-/** Points the shared layer at one provider and stubs that provider's SDK. */
+/** Points the shared layer at one provider via the SANDBOX_PROVIDER env var. */
 function useProvider(provider: Provider) {
-  mockIsFeatureEnabled.mockResolvedValue(provider === 'daytona')
+  mockEnv.SANDBOX_PROVIDER = provider
 }
 
 /** Stubs a code execution that prints `stdout` and emits `result` via the marker. */
@@ -295,11 +293,11 @@ describe.each(PROVIDERS)('sandbox conformance [%s]', (provider) => {
 })
 
 describe('provider selection', () => {
-  it('routes to E2B when the flag is off and Daytona when it is on', async () => {
+  it('routes by SANDBOX_PROVIDER, defaulting to E2B when unset', async () => {
     stubCodeRun('e2b', `${SIM_RESULT_PREFIX}null`)
     stubCodeRun('daytona', `${SIM_RESULT_PREFIX}null`)
 
-    useProvider('e2b')
+    mockEnv.SANDBOX_PROVIDER = undefined
     await executeInSandbox({ code: 'x', language: CodeLanguage.Python, timeoutMs: 1000 })
     expect(mockE2BCreate).toHaveBeenCalledTimes(1)
     expect(mockDaytonaCreate).not.toHaveBeenCalled()
@@ -309,6 +307,13 @@ describe('provider selection', () => {
     expect(mockDaytonaCreate).toHaveBeenCalledTimes(1)
   })
 
+  it('throws on an unknown SANDBOX_PROVIDER', async () => {
+    mockEnv.SANDBOX_PROVIDER = 'modal'
+    await expect(
+      executeInSandbox({ code: 'x', language: CodeLanguage.Python, timeoutMs: 1000 })
+    ).rejects.toThrow(/Unknown SANDBOX_PROVIDER "modal"/)
+  })
+
   it('binds language at create time so JS never runs through the Python toolbox', async () => {
     useProvider('daytona')
     mockProcessCodeRun.mockResolvedValue({ result: `${SIM_RESULT_PREFIX}null`, exitCode: 0 })
@@ -325,9 +330,8 @@ describe('provider selection', () => {
 
   it('fails closed when a Daytona snapshot id is unset', async () => {
     useProvider('daytona')
-    const { env } = await import('@/lib/core/config/env')
-    const original = env.DAYTONA_DOC_SNAPSHOT_ID
-    ;(env as { DAYTONA_DOC_SNAPSHOT_ID?: string }).DAYTONA_DOC_SNAPSHOT_ID = undefined
+    const original = mockEnv.DAYTONA_DOC_SNAPSHOT_ID
+    mockEnv.DAYTONA_DOC_SNAPSHOT_ID = undefined
 
     await expect(
       executeInSandbox({
@@ -337,6 +341,6 @@ describe('provider selection', () => {
         sandboxKind: 'doc',
       })
     ).rejects.toThrow(/DAYTONA_DOC_SNAPSHOT_ID is unset/)
-    ;(env as { DAYTONA_DOC_SNAPSHOT_ID?: string }).DAYTONA_DOC_SNAPSHOT_ID = original
+    mockEnv.DAYTONA_DOC_SNAPSHOT_ID = original
   })
 })

apps/sim/lib/execution/remote-sandbox/index.ts

@@ -1,6 +1,6 @@
 import { createLogger } from '@sim/logger'
 import { getErrorMessage } from '@sim/utils/errors'
-import { isFeatureEnabled } from '@/lib/core/config/feature-flags'
+import { env } from '@/lib/core/config/env'
 import type { CodeLanguage } from '@/lib/execution/languages'
 import { daytonaProvider } from '@/lib/execution/remote-sandbox/daytona'
 import { e2bProvider } from '@/lib/execution/remote-sandbox/e2b'
@@ -12,6 +12,7 @@ import type {
   SandboxHandle,
   SandboxKind,
   SandboxProvider,
+  SandboxProviderId,
   SandboxShellExecutionRequest,
 } from '@/lib/execution/remote-sandbox/types'
 
@@ -25,24 +26,44 @@ export type {
 const logger = createLogger('RemoteSandbox')
 
 /**
- * Resolves which provider serves this execution.
+ * The known sandbox providers. Keyed by {@link SandboxProviderId}, so adding an
+ * adapter is one entry here plus one member on the id union — the type makes an
+ * unhandled provider a compile error, not a runtime surprise.
+ */
+const PROVIDERS: Record<SandboxProviderId, SandboxProvider> = {
+  e2b: e2bProvider,
+  daytona: daytonaProvider,
+}
+
+const DEFAULT_PROVIDER: SandboxProviderId = 'e2b'
+
+/**
+ * Resolves which provider serves this execution from the `SANDBOX_PROVIDER` env
+ * var (defaulting to {@link DEFAULT_PROVIDER}).
  *
  * Selection is deliberately resolved ONCE, before the sandbox is created, and is
  * never revisited mid-execution: user code has side effects (HTTP calls, S3
- * writes, DB mutations), so retrying a partially-executed run on the other
- * provider could duplicate them. This is a manual failover — flip the
- * `sandbox-provider-daytona` flag and new executions move over.
+ * writes, DB mutations), so retrying a partially-executed run on another provider
+ * could duplicate them. Changing providers is a config change — set
+ * `SANDBOX_PROVIDER` and redeploy; in-flight executions are unaffected.
  */
-async function resolveProvider(): Promise<SandboxProvider> {
-  const useDaytona = await isFeatureEnabled('sandbox-provider-daytona')
-  return useDaytona ? daytonaProvider : e2bProvider
+function resolveProvider(): SandboxProvider {
+  const configured = env.SANDBOX_PROVIDER
+  if (!configured) return PROVIDERS[DEFAULT_PROVIDER]
+  const provider = PROVIDERS[configured as SandboxProviderId]
+  if (!provider) {
+    throw new Error(
+      `Unknown SANDBOX_PROVIDER "${configured}" (expected one of: ${Object.keys(PROVIDERS).join(', ')})`
+    )
+  }
+  return provider
 }
 
 async function createSandbox(
   kind: SandboxKind,
   options?: { language?: CodeLanguage }
 ): Promise<SandboxHandle> {
-  const provider = await resolveProvider()
+  const provider = resolveProvider()
   const sandbox = await provider.create(kind, options)
   logger.info('Created sandbox', { provider: provider.id, kind, sandboxId: sandbox.sandboxId })
   return sandbox

apps/sim/scripts/verify-sandbox-parity.ts

@@ -2,21 +2,20 @@
 
 /**
  * Runs the real sandbox execution paths against whichever provider the
- * `sandbox-provider-daytona` flag currently selects, and prints a pass/fail
- * matrix.
+ * `SANDBOX_PROVIDER` env var selects, and prints a pass/fail matrix.
  *
- * This is the pre-flip confidence check: run it against E2B, run it against
+ * This is the pre-switch confidence check: run it against E2B, run it against
  * Daytona, and compare. Every case exercises the shared layer end-to-end
  * (`executeInSandbox` / `executeShellInSandbox`) against a live sandbox — not
  * mocks — so it catches the failures unit tests cannot: a missing package, an
  * expired snapshot, an image that vanished during an org move, blocked egress.
  *
  * Usage:
- *   # E2B (flag off)
+ *   # E2B (default)
  *   bun run apps/sim/scripts/verify-sandbox-parity.ts
  *
- *   # Daytona (flag on via its env fallback)
- *   SANDBOX_PROVIDER_DAYTONA=true \
+ *   # Daytona
+ *   SANDBOX_PROVIDER=daytona \
  *   DAYTONA_SHELL_SNAPSHOT_ID=mothership-shell:<tag> \
  *   DAYTONA_DOC_SNAPSHOT_ID=mothership-docs:<tag> \
  *     bun run apps/sim/scripts/verify-sandbox-parity.ts
@@ -153,7 +152,7 @@ const CASES: Case[] = [
 ]
 
 async function main() {
-  const provider = process.env.SANDBOX_PROVIDER_DAYTONA ? 'daytona' : 'e2b'
+  const provider = process.env.SANDBOX_PROVIDER || 'e2b'
   const docConfigured =
     provider === 'daytona'
       ? Boolean(process.env.DAYTONA_DOC_SNAPSHOT_ID)