feat(sandbox): add Daytona as a manual-flip failover for E2B

E2B was a hard single point of failure: lib/execution/e2b.ts had no retry
and no fallback, so a failed Sandbox.create() killed Python function blocks,
JS-with-imports, shell, doc generation and the Pi cloud agent outright.

Extract a SandboxRunner boundary (lib/execution/remote-sandbox) with an E2B
runner and a Daytona runner, selected once per execution by the
sandbox-provider-daytona AppConfig flag. Everything above the provider
boundary — marker parsing, mount materialization, file export, corruption
handling — is unchanged.

Selection resolves before create() and never mid-execution, since user code
has side effects. Each sandbox kind fails closed when its snapshot id is unset.

Notes on the Daytona adapter:
- language binds at create(), not per call: Daytona applies it as a sandbox
  label and silently runs JS through Python if passed to codeRun
- Python routes via CodeInterpreter for its {name,value,traceback} error shape,
  which matches E2B's and keeps formatE2BError's line offsets correct
- timeouts convert ms to seconds
- the streaming path delivers env via the filesystem API, as
  SessionExecuteRequest has no env field and secrets must not reach a command line

Drops the dead E2BExecutionResult.images field (populated, never consumed).

Author: TheodoreSpeaks

apps/sim/app/api/function/execute/route.test.ts

@@ -13,7 +13,7 @@ import { NextRequest } from 'next/server'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
 const {
-  mockExecuteInE2B,
+  mockExecuteInSandbox,
   mockExecuteInIsolatedVM,
   mockFetchWorkspaceFileBuffer,
   mockGetWorkspaceFile,
@@ -23,7 +23,7 @@ const {
   mockValidateWorkspaceFileWriteTarget,
   mockWriteWorkspaceFileByPath,
 } = vi.hoisted(() => ({
-  mockExecuteInE2B: vi.fn(),
+  mockExecuteInSandbox: vi.fn(),
   mockExecuteInIsolatedVM: vi.fn(),
   mockFetchWorkspaceFileBuffer: vi.fn(),
   mockGetWorkspaceFile: vi.fn(),
@@ -38,9 +38,9 @@ vi.mock('@/lib/execution/isolated-vm', () => ({
   executeInIsolatedVM: mockExecuteInIsolatedVM,
 }))
 
-vi.mock('@/lib/execution/e2b', () => ({
-  executeInE2B: mockExecuteInE2B,
-  executeShellInE2B: vi.fn(),
+vi.mock('@/lib/execution/remote-sandbox', () => ({
+  executeInSandbox: mockExecuteInSandbox,
+  executeShellInSandbox: vi.fn(),
   SIM_RESULT_PREFIX: '__SIM_RESULT__=',
 }))
 
@@ -124,7 +124,7 @@ describe('Function Execute API Route', () => {
     mockUploadFile.mockImplementation(async ({ customKey }) => ({ key: customKey }))
     clearLargeValueCacheForTests()
 
-    mockExecuteInE2B.mockResolvedValue({
+    mockExecuteInSandbox.mockResolvedValue({
       result: 'e2b success',
       stdout: 'e2b output',
       sandboxId: 'test-sandbox-id',
@@ -351,7 +351,7 @@ describe('Function Execute API Route', () => {
 
     it('exports multiple declared sandbox output files', async () => {
       envFlagsMock.isE2bEnabled = true
-      mockExecuteInE2B.mockResolvedValueOnce({
+      mockExecuteInSandbox.mockResolvedValueOnce({
         result: 'done',
         stdout: 'ok',
         sandboxId: 'sandbox-123',
@@ -388,7 +388,7 @@ describe('Function Execute API Route', () => {
 
       expect(response.status).toBe(200)
       expect(data.success).toBe(true)
-      expect(mockExecuteInE2B).toHaveBeenCalledWith(
+      expect(mockExecuteInSandbox).toHaveBeenCalledWith(
         expect.objectContaining({
           outputSandboxPaths: ['/home/user/chart.png', '/home/user/summary.json'],
         })
@@ -419,7 +419,7 @@ describe('Function Execute API Route', () => {
 
     it('prevalidates all sandbox output destinations before writing any files', async () => {
       envFlagsMock.isE2bEnabled = true
-      mockExecuteInE2B.mockResolvedValueOnce({
+      mockExecuteInSandbox.mockResolvedValueOnce({
         result: 'done',
         stdout: 'ok',
         sandboxId: 'sandbox-123',
@@ -463,7 +463,7 @@ describe('Function Execute API Route', () => {
 
     it('rejects duplicate sandbox output destinations before writing files', async () => {
       envFlagsMock.isE2bEnabled = true
-      mockExecuteInE2B.mockResolvedValueOnce({
+      mockExecuteInSandbox.mockResolvedValueOnce({
         result: 'done',
         stdout: 'ok',
         sandboxId: 'sandbox-123',
@@ -508,7 +508,7 @@ describe('Function Execute API Route', () => {
 
     it('returns a targeted error when a declared sandbox output is missing', async () => {
       envFlagsMock.isE2bEnabled = true
-      mockExecuteInE2B.mockResolvedValueOnce({
+      mockExecuteInSandbox.mockResolvedValueOnce({
         result: 'done',
         stdout: 'ok',
         sandboxId: 'sandbox-123',
@@ -564,7 +564,7 @@ describe('Function Execute API Route', () => {
       expect(data.success).toBe(false)
       expect(data.error).toContain('no sandbox filesystem')
       expect(mockExecuteInIsolatedVM).not.toHaveBeenCalled()
-      expect(mockExecuteInE2B).not.toHaveBeenCalled()
+      expect(mockExecuteInSandbox).not.toHaveBeenCalled()
       expect(mockWriteWorkspaceFileByPath).not.toHaveBeenCalled()
     })
 
@@ -590,7 +590,7 @@ describe('Function Execute API Route', () => {
     it('flags an overwrite export whose bytes are identical to the current file content as unchanged', async () => {
       envFlagsMock.isE2bEnabled = true
       const staleContent = '# doc\nunchanged mounted content\n'
-      mockExecuteInE2B.mockResolvedValueOnce({
+      mockExecuteInSandbox.mockResolvedValueOnce({
         result: 'done',
         stdout: 'ok',
         sandboxId: 'sandbox-123',
@@ -637,7 +637,7 @@ describe('Function Execute API Route', () => {
     it('reports size, previousSize, and sha256 receipts on a successful overwrite export', async () => {
       envFlagsMock.isE2bEnabled = true
       const newContent = '# doc\nnew content\n'
-      mockExecuteInE2B.mockResolvedValueOnce({
+      mockExecuteInSandbox.mockResolvedValueOnce({
         result: 'done',
         stdout: 'ok',
         sandboxId: 'sandbox-123',
@@ -681,7 +681,7 @@ describe('Function Execute API Route', () => {
       expect(data.output.result.message).toContain('sha256:')
       // The python wrapper prints the marker with a leading \n so it always
       // starts a fresh line even after non-newline-terminated user output.
-      const e2bCode = mockExecuteInE2B.mock.calls[0][0].code as string
+      const e2bCode = mockExecuteInSandbox.mock.calls[0][0].code as string
       expect(e2bCode).toContain("print('\\n__SIM_RESULT__=' + json.dumps(__sim_result__))")
     })
 

apps/sim/app/api/function/execute/route.ts

@@ -19,7 +19,6 @@ import {
 import { isE2bEnabled } from '@/lib/core/config/env-flags'
 import { generateRequestId } from '@/lib/core/utils/request'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
-import { executeInE2B, executeShellInE2B, SIM_RESULT_PREFIX } from '@/lib/execution/e2b'
 import { executeInIsolatedVM, type IsolatedVMBrokerHandler } from '@/lib/execution/isolated-vm'
 import { CodeLanguage, DEFAULT_CODE_LANGUAGE, isValidCodeLanguage } from '@/lib/execution/languages'
 import { recordMaterializedAccessKeys } from '@/lib/execution/payloads/access-keys'
@@ -36,6 +35,11 @@ import {
 } from '@/lib/execution/payloads/materialization.server'
 import { compactExecutionPayload } from '@/lib/execution/payloads/serializer'
 import { materializeLargeValueRef } from '@/lib/execution/payloads/store'
+import {
+  executeInSandbox,
+  executeShellInSandbox,
+  SIM_RESULT_PREFIX,
+} from '@/lib/execution/remote-sandbox'
 import { isExecutionResourceLimitError } from '@/lib/execution/resource-errors'
 import {
   fetchWorkspaceFileBuffer,
@@ -1537,7 +1541,7 @@ export const POST = withRouteHandler(async (req: NextRequest) => {
         error: shellError,
         exportedFileContent,
         exportedFiles,
-      } = await executeShellInE2B({
+      } = await executeShellInSandbox({
         code: resolvedCode,
         envs: shellEnvs,
         timeoutMs: timeout,
@@ -1693,7 +1697,7 @@ export const POST = withRouteHandler(async (req: NextRequest) => {
           error: e2bError,
           exportedFileContent,
           exportedFiles,
-        } = await executeInE2B({
+        } = await executeInSandbox({
           code: codeForE2B,
           language: CodeLanguage.JavaScript,
           timeoutMs: timeout,
@@ -1781,7 +1785,7 @@ export const POST = withRouteHandler(async (req: NextRequest) => {
         error: e2bError,
         exportedFileContent,
         exportedFiles,
-      } = await executeInE2B({
+      } = await executeInSandbox({
         code: codeForE2B,
         language: CodeLanguage.Python,
         timeoutMs: timeout,

apps/sim/executor/handlers/pi/cloud-backend.test.ts

@@ -13,7 +13,7 @@ const { mockRun, mockReadFile, mockWriteFile, mockExecuteTool, mockProviderEnvVa
   })
 )
 
-vi.mock('@/lib/execution/e2b', () => ({
+vi.mock('@/lib/execution/remote-sandbox', () => ({
   withPiSandbox: (fn: (runner: unknown) => unknown) =>
     fn({ run: mockRun, readFile: mockReadFile, writeFile: mockWriteFile }),
 }))

apps/sim/executor/handlers/pi/cloud-backend.ts

@@ -15,7 +15,7 @@
 import { createLogger } from '@sim/logger'
 import { generateShortId } from '@sim/utils/id'
 import { truncate } from '@sim/utils/string'
-import { withPiSandbox } from '@/lib/execution/e2b'
+import { withPiSandbox } from '@/lib/execution/remote-sandbox'
 import type { PiBackendRun, PiCloudRunParams } from '@/executor/handlers/pi/backend'
 import {
   CLONE_TIMEOUT_MS,

apps/sim/executor/handlers/pi/cloud-review-backend.test.ts

@@ -62,7 +62,7 @@ const mockModelRuntime = {
 vi.mock('@sim/logger', () => ({
   createLogger: () => ({ info: vi.fn(), warn: mockLoggerWarn }),
 }))
-vi.mock('@/lib/execution/e2b', () => ({
+vi.mock('@/lib/execution/remote-sandbox', () => ({
   withPiSandbox: (fn: (runner: unknown) => unknown) =>
     fn({ run: mockRun, writeFile: mockWriteFile }),
 }))

apps/sim/executor/handlers/pi/cloud-review-backend.ts

@@ -9,7 +9,7 @@ import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { createLogger } from '@sim/logger'
 import { truncate } from '@sim/utils/string'
-import { withPiSandbox } from '@/lib/execution/e2b'
+import { withPiSandbox } from '@/lib/execution/remote-sandbox'
 import type { PiBackendRun, PiCloudReviewRunParams } from '@/executor/handlers/pi/backend'
 import {
   CLOUD_REVIEW_TOOL_NAMES,

apps/sim/executor/handlers/pi/cloud-review-tools.test.ts

@@ -8,7 +8,7 @@ import { join } from 'node:path'
 import { promisify } from 'node:util'
 import * as sdk from '@earendil-works/pi-coding-agent'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
-import type { PiSandboxRunner } from '@/lib/execution/e2b'
+import type { PiSandboxRunner } from '@/lib/execution/remote-sandbox'
 import {
   CLOUD_REVIEW_TOOL_NAMES,
   createCloudReviewTools,

apps/sim/executor/handlers/pi/cloud-review-tools.ts

@@ -1,6 +1,6 @@
 import type { ToolDefinition } from '@earendil-works/pi-coding-agent'
 import { Type } from 'typebox'
-import type { PiSandboxRunner } from '@/lib/execution/e2b'
+import type { PiSandboxRunner } from '@/lib/execution/remote-sandbox'
 import { REVIEW_TOOLS_SCRIPT } from '@/executor/handlers/pi/cloud-review-tools-script'
 import { raceAbort } from '@/executor/handlers/pi/cloud-shared'
 import type { PiSdk } from '@/executor/handlers/pi/pi-sdk'

apps/sim/lib/copilot/tools/server/files/doc-compile.test.ts

@@ -3,9 +3,9 @@
  */
 import { describe, expect, it, vi } from 'vitest'
 
-vi.mock('@/lib/execution/e2b', () => ({
-  executeInE2B: vi.fn(),
-  executeShellInE2B: vi.fn(),
+vi.mock('@/lib/execution/remote-sandbox', () => ({
+  executeInSandbox: vi.fn(),
+  executeShellInSandbox: vi.fn(),
 }))
 vi.mock('@/lib/execution/languages', () => ({
   CodeLanguage: { javascript: 'javascript', python: 'python' },

apps/sim/lib/copilot/tools/server/files/doc-compile.ts

@@ -3,8 +3,12 @@ import { sha256Hex } from '@sim/security/hash'
 import { getErrorMessage } from '@sim/utils/errors'
 import { isE2BDocEnabled } from '@/lib/core/config/env-flags'
 import { isFeatureEnabled } from '@/lib/core/config/feature-flags'
-import { executeInE2B, executeShellInE2B, type SandboxFile } from '@/lib/execution/e2b'
 import { CodeLanguage } from '@/lib/execution/languages'
+import {
+  executeInSandbox,
+  executeShellInSandbox,
+  type SandboxFile,
+} from '@/lib/execution/remote-sandbox'
 import { runSandboxTask } from '@/lib/execution/sandbox/run-task'
 import {
   fetchWorkspaceFileBuffer,
@@ -259,7 +263,7 @@ async function compileDocViaE2BPython(
   // unaffected. Runs only after the user's script succeeds.
   const code = fmt.ext === 'xlsx' ? `${source}\n${XLSX_RECALC_SNIPPET}` : source
 
-  const result = await executeInE2B({
+  const result = await executeInSandbox({
     code,
     language: CodeLanguage.Python,
     timeoutMs: DOC_COMPILE_TIMEOUT_MS,
@@ -342,7 +346,7 @@ ${finalize}
 })().then(() => console.log('__DOC_OK__')).catch((e) => { console.error('__DOC_ERR__' + (e && e.message ? e.message : String(e))); process.exit(1); });
 `
 
-  const result = await executeShellInE2B({
+  const result = await executeShellInSandbox({
     code: 'NODE_PATH=$(npm root -g) node /home/user/script.js',
     envs: {},
     timeoutMs: DOC_COMPILE_TIMEOUT_MS,