diff --git a/sdks/sandbox/go/Makefile b/sdks/sandbox/go/Makefile
new file mode 100644
index 00000000..dc5f1d02
--- /dev/null
+++ b/sdks/sandbox/go/Makefile
@@ -0,0 +1,27 @@
+.PHONY: all build vet test lint generate
+
+all: build vet test
+
+generate:
+	cd opensandbox/api/lifecycle && oapi-codegen --config cfg.yaml ../specs/sandbox-lifecycle.yml
+	cd opensandbox/api/execd    && oapi-codegen --config cfg.yaml ../specs/execd-api.yaml
+	cd opensandbox/api/egress   && oapi-codegen --config cfg.yaml ../specs/egress-api.yaml
+	@echo "Generated all API clients from OpenAPI specs"
+
+build:
+	go build ./...
+
+vet:
+	go vet ./...
+
+test:
+	go test ./opensandbox/ -v
+
+test-integration:
+	go test -tags=integration ./opensandbox/ -v -timeout 3m
+
+test-staging:
+	go test -tags=staging ./opensandbox/ -v -timeout 3m
+
+lint:
+	@which staticcheck >/dev/null 2>&1 && staticcheck ./... || echo "staticcheck not installed — skipping lint"
diff --git a/sdks/sandbox/go/README.md b/sdks/sandbox/go/README.md
new file mode 100644
index 00000000..3e5af776
--- /dev/null
+++ b/sdks/sandbox/go/README.md
@@ -0,0 +1,238 @@
+# OpenSandbox Go SDK
+
+Go client library for the [OpenSandbox](https://github.com/alibaba/OpenSandbox) API.
+
+Covers all three OpenAPI specs:
+- **Lifecycle** — Create, manage, and destroy sandbox instances
+- **Execd** — Execute commands, manage files, monitor metrics inside sandboxes
+- **Egress** — Inspect and mutate sandbox network policy at runtime
+
+## Installation
+
+```bash
+go get github.com/alibaba/OpenSandbox/sdks/sandbox/go
+```
+
+## Quick Start
+
+### Create and manage a sandbox
+
+```go
+package main
+
+import (
+    "context"
+    "fmt"
+    "log"
+
+    "github.com/alibaba/OpenSandbox/sdks/sandbox/go/opensandbox"
+)
+
+func main() {
+    ctx := context.Background()
+
+    // Create a lifecycle client
+    lc := opensandbox.NewLifecycleClient("http://localhost:8080/v1", "your-api-key")
+
+    // Create a sandbox
+    sbx, err := lc.CreateSandbox(ctx, opensandbox.CreateSandboxRequest{
+        Image:      opensandbox.ImageSpec{URI: "python:3.12"},
+        Entrypoint: []string{"/bin/sh"},
+        ResourceLimits: opensandbox.ResourceLimits{
+            "cpu":    "500m",
+            "memory": "512Mi",
+        },
+    })
+    if err != nil {
+        log.Fatal(err)
+    }
+    fmt.Printf("Created sandbox: %s (state: %s)\n", sbx.ID, sbx.Status.State)
+
+    // Get sandbox details
+    sbx, err = lc.GetSandbox(ctx, sbx.ID)
+    if err != nil {
+        log.Fatal(err)
+    }
+
+    // List all running sandboxes
+    list, err := lc.ListSandboxes(ctx, opensandbox.ListOptions{
+        States:   []opensandbox.SandboxState{opensandbox.StateRunning},
+        PageSize: 10,
+    })
+    if err != nil {
+        log.Fatal(err)
+    }
+    fmt.Printf("Running sandboxes: %d\n", list.Pagination.TotalItems)
+
+    // Pause and resume
+    _ = lc.PauseSandbox(ctx, sbx.ID)
+    _ = lc.ResumeSandbox(ctx, sbx.ID)
+
+    // Clean up
+    _ = lc.DeleteSandbox(ctx, sbx.ID)
+}
+```
+
+### Run a command with streaming output
+
+```go
+exec := opensandbox.NewExecdClient("http://localhost:9090", "your-execd-token")
+
+err := exec.RunCommand(ctx, opensandbox.RunCommandRequest{
+    Command: "echo 'Hello from sandbox!'",
+    Timeout: 30000,
+}, func(event opensandbox.StreamEvent) error {
+    // event.Event is populated from the NDJSON "type" field automatically.
+    switch event.Event {
+    case "stdout":
+        fmt.Print(event.Data)
+    case "stderr":
+        fmt.Fprintf(os.Stderr, "%s", event.Data)
+    case "execution_complete":
+        fmt.Println("\n[done]")
+    }
+    return nil
+})
+```
+
+### Check egress policy
+
+```go
+egress := opensandbox.NewEgressClient("http://localhost:18080", "your-egress-token")
+
+// Get current policy
+policy, err := egress.GetPolicy(ctx)
+fmt.Printf("Mode: %s, Default: %s\n", policy.Mode, policy.Policy.DefaultAction)
+
+// Add a rule
+updated, err := egress.PatchPolicy(ctx, []opensandbox.NetworkRule{
+    {Action: "allow", Target: "api.example.com"},
+})
+```
+
+## API Reference
+
+### LifecycleClient
+
+Created with `NewLifecycleClient(baseURL, apiKey string, opts ...Option)`.
+
+| Method | Description |
+|--------|-------------|
+| `CreateSandbox(ctx, req)` | Create a new sandbox from a container image |
+| `GetSandbox(ctx, id)` | Get sandbox details by ID |
+| `ListSandboxes(ctx, opts)` | List sandboxes with filtering and pagination |
+| `DeleteSandbox(ctx, id)` | Delete a sandbox |
+| `PauseSandbox(ctx, id)` | Pause a running sandbox |
+| `ResumeSandbox(ctx, id)` | Resume a paused sandbox |
+| `RenewExpiration(ctx, id, expiresAt)` | Extend sandbox expiration time |
+| `GetEndpoint(ctx, sandboxID, port, useServerProxy)` | Get public endpoint for a sandbox port |
+
+### ExecdClient
+
+Created with `NewExecdClient(baseURL, accessToken string, opts ...Option)`.
+
+**Health:**
+| Method | Description |
+|--------|-------------|
+| `Ping(ctx)` | Check server health |
+
+**Code Execution:**
+| Method | Description |
+|--------|-------------|
+| `ListContexts(ctx, language)` | List active code execution contexts |
+| `CreateContext(ctx, req)` | Create a code execution context |
+| `GetContext(ctx, contextID)` | Get context details |
+| `DeleteContext(ctx, contextID)` | Delete a context |
+| `DeleteContextsByLanguage(ctx, language)` | Delete all contexts for a language |
+| `ExecuteCode(ctx, req, handler)` | Execute code with SSE streaming |
+| `InterruptCode(ctx, sessionID)` | Interrupt running code |
+
+**Command Execution:**
+| Method | Description |
+|--------|-------------|
+| `CreateSession(ctx)` | Create a bash session |
+| `RunInSession(ctx, sessionID, req, handler)` | Run command in session with SSE |
+| `DeleteSession(ctx, sessionID)` | Delete a bash session |
+| `RunCommand(ctx, req, handler)` | Run a command with SSE streaming |
+| `InterruptCommand(ctx, sessionID)` | Interrupt running command |
+| `GetCommandStatus(ctx, commandID)` | Get command execution status |
+| `GetCommandLogs(ctx, commandID, cursor)` | Get command stdout/stderr |
+
+**File Operations:**
+| Method | Description |
+|--------|-------------|
+| `GetFileInfo(ctx, path)` | Get file metadata |
+| `DeleteFiles(ctx, paths)` | Delete files |
+| `SetPermissions(ctx, req)` | Change file permissions |
+| `MoveFiles(ctx, req)` | Move/rename files |
+| `SearchFiles(ctx, dir, pattern)` | Search files by glob pattern |
+| `ReplaceInFiles(ctx, req)` | Text replacement in files |
+| `UploadFile(ctx, localPath, remotePath)` | Upload a file to the sandbox |
+| `DownloadFile(ctx, remotePath, rangeHeader)` | Download a file from the sandbox |
+
+**Directory Operations:**
+| Method | Description |
+|--------|-------------|
+| `CreateDirectory(ctx, path, mode)` | Create a directory (mkdir -p) |
+| `DeleteDirectory(ctx, path)` | Delete a directory recursively |
+
+**Metrics:**
+| Method | Description |
+|--------|-------------|
+| `GetMetrics(ctx)` | Get system resource metrics |
+| `WatchMetrics(ctx, handler)` | Stream metrics via SSE |
+
+### EgressClient
+
+Created with `NewEgressClient(baseURL, authToken string, opts ...Option)`.
+
+| Method | Description |
+|--------|-------------|
+| `GetPolicy(ctx)` | Get current egress policy |
+| `PatchPolicy(ctx, rules)` | Merge rules into current policy |
+
+## SSE Streaming
+
+Methods that stream output (`RunCommand`, `ExecuteCode`, `RunInSession`, `WatchMetrics`) accept an `EventHandler` callback:
+
+```go
+type EventHandler func(event StreamEvent) error
+```
+
+Each `StreamEvent` contains:
+- `Event` — the event type (e.g. `"stdout"`, `"stderr"`, `"result"`, `"execution_complete"`). For NDJSON streams, this is extracted from the JSON `type` field automatically.
+- `Data` — the raw event payload (JSON string for NDJSON streams).
+- `ID` — optional event identifier
+
+Return a non-nil error from the handler to stop processing the stream early.
+
+## Client Options
+
+All client constructors accept optional `Option` functions:
+
+```go
+// Use a custom http.Client
+client := opensandbox.NewLifecycleClient(url, key,
+    opensandbox.WithHTTPClient(myHTTPClient),
+)
+
+// Set a custom timeout
+client := opensandbox.NewExecdClient(url, token,
+    opensandbox.WithTimeout(60 * time.Second),
+)
+```
+
+## Error Handling
+
+Non-2xx responses are returned as `*opensandbox.APIError`:
+
+```go
+_, err := lc.GetSandbox(ctx, "nonexistent")
+if apiErr, ok := err.(*opensandbox.APIError); ok {
+    fmt.Printf("HTTP %d: %s — %s\n", apiErr.StatusCode, apiErr.Response.Code, apiErr.Response.Message)
+}
+```
+
+## License
+
+Apache 2.0
diff --git a/sdks/sandbox/go/examples/agent_loop/main.go b/sdks/sandbox/go/examples/agent_loop/main.go
new file mode 100644
index 00000000..2ba58fc2
--- /dev/null
+++ b/sdks/sandbox/go/examples/agent_loop/main.go
@@ -0,0 +1,134 @@
+// Example: Simple Agent Loop
+//
+// Demonstrates a basic AI agent that:
+// 1. Gets a task from the user
+// 2. Asks an LLM to write Python code
+// 3. Executes the code in an OpenSandbox sandbox
+// 4. Returns the result
+//
+// Usage:
+//
+//	export OPEN_SANDBOX_DOMAIN=localhost:8080
+//	export OPEN_SANDBOX_API_KEY=your-api-key
+//	export LLM_ENDPOINT=http://localhost:8080/v1  # OpenAI-compatible endpoint
+//	export LLM_MODEL=gpt-4o-mini                   # or azure/gpt-4o-mini for Bifrost
+//	go run main.go "Calculate the first 20 prime numbers"
+package main
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"os"
+	"strings"
+	"time"
+
+	"github.com/alibaba/OpenSandbox/sdks/sandbox/go/opensandbox"
+)
+
+func main() {
+	task := "Calculate the first 10 Fibonacci numbers and print them"
+	if len(os.Args) > 1 {
+		task = strings.Join(os.Args[1:], " ")
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Minute)
+	defer cancel()
+
+	// 1. Create sandbox
+	fmt.Println("Creating sandbox...")
+	config := opensandbox.ConnectionConfig{}
+	sb, err := opensandbox.CreateSandbox(ctx, config, opensandbox.SandboxCreateOptions{
+		Image: "python:3.11-slim",
+	})
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "Failed to create sandbox: %v\n", err)
+		os.Exit(1)
+	}
+	defer sb.Kill(context.Background())
+	fmt.Printf("Sandbox ready: %s\n", sb.ID())
+
+	// 2. Ask LLM for code
+	fmt.Printf("Task: %s\n", task)
+	code, err := askLLM(ctx, task)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "LLM error: %v\n", err)
+		os.Exit(1)
+	}
+	fmt.Printf("Generated code:\n%s\n\n", code)
+
+	// 3. Execute in sandbox
+	fmt.Println("Executing in sandbox...")
+	sb.RunCommand(ctx, fmt.Sprintf("cat > /tmp/task.py << 'EOF'\n%s\nEOF", code), nil)
+	exec, err := sb.RunCommand(ctx, "python3 /tmp/task.py", nil)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "Execution error: %v\n", err)
+		os.Exit(1)
+	}
+
+	// 4. Show result
+	fmt.Printf("Result:\n%s\n", exec.Text())
+	if exec.ExitCode != nil {
+		fmt.Printf("Exit code: %d\n", *exec.ExitCode)
+	}
+}
+
+func askLLM(ctx context.Context, task string) (string, error) {
+	endpoint := os.Getenv("LLM_ENDPOINT")
+	if endpoint == "" {
+		return "", fmt.Errorf("LLM_ENDPOINT not set")
+	}
+	model := os.Getenv("LLM_MODEL")
+	if model == "" {
+		model = "gpt-4o-mini"
+	}
+
+	body, _ := json.Marshal(map[string]any{
+		"model": model,
+		"messages": []map[string]string{
+			{"role": "system", "content": "Respond ONLY with a Python code block. No explanation."},
+			{"role": "user", "content": task},
+		},
+		"max_tokens": 1024,
+	})
+
+	req, _ := http.NewRequestWithContext(ctx, "POST", endpoint+"/chat/completions", bytes.NewReader(body))
+	req.Header.Set("Content-Type", "application/json")
+
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		return "", err
+	}
+	defer resp.Body.Close()
+	data, _ := io.ReadAll(resp.Body)
+
+	var result struct {
+		Choices []struct {
+			Message struct {
+				Content string `json:"content"`
+			} `json:"message"`
+		} `json:"choices"`
+	}
+	json.Unmarshal(data, &result)
+	if len(result.Choices) == 0 {
+		return "", fmt.Errorf("no response from LLM: %s", string(data))
+	}
+
+	text := result.Choices[0].Message.Content
+	// Extract code from markdown block
+	if start := strings.Index(text, "```python"); start != -1 {
+		text = text[start+9:]
+		if end := strings.Index(text, "```"); end != -1 {
+			text = text[:end]
+		}
+	} else if start := strings.Index(text, "```"); start != -1 {
+		text = text[start+3:]
+		if end := strings.Index(text, "```"); end != -1 {
+			text = text[:end]
+		}
+	}
+	return strings.TrimSpace(text), nil
+}
diff --git a/sdks/sandbox/go/examples/code_interpreter_agent/main.go b/sdks/sandbox/go/examples/code_interpreter_agent/main.go
new file mode 100644
index 00000000..53b2f47a
--- /dev/null
+++ b/sdks/sandbox/go/examples/code_interpreter_agent/main.go
@@ -0,0 +1,140 @@
+// Example: Multi-turn Code Interpreter Agent
+//
+// Demonstrates an AI agent that maintains persistent Python state across
+// multiple conversation turns using OpenSandbox's code interpreter:
+//
+// Turn 1: LLM creates a dataset
+// Turn 2: LLM analyzes it (variables persist from turn 1)
+// Turn 3: LLM generates a summary
+//
+// Usage:
+//
+//	export OPEN_SANDBOX_DOMAIN=localhost:8080
+//	export OPEN_SANDBOX_API_KEY=your-api-key
+//	export LLM_ENDPOINT=http://localhost:8080/v1
+//	export LLM_MODEL=gpt-4o-mini
+//	go run main.go
+package main
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"os"
+	"strings"
+	"time"
+
+	"github.com/alibaba/OpenSandbox/sdks/sandbox/go/opensandbox"
+)
+
+func main() {
+	ctx, cancel := context.WithTimeout(context.Background(), 3*time.Minute)
+	defer cancel()
+
+	// Create code interpreter sandbox
+	fmt.Println("Creating code interpreter...")
+	config := opensandbox.ConnectionConfig{}
+	ci, err := opensandbox.CreateCodeInterpreter(ctx, config, opensandbox.CodeInterpreterCreateOptions{
+		ReadyTimeout: 60 * time.Second,
+	})
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "Failed: %v\n", err)
+		os.Exit(1)
+	}
+	defer ci.Kill(context.Background())
+	fmt.Printf("Ready: %s\n\n", ci.ID())
+
+	// Create persistent Python context
+	codeCtx, err := ci.CreateContext(ctx, opensandbox.CreateContextRequest{Language: "python"})
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "CreateContext: %v\n", err)
+		os.Exit(1)
+	}
+
+	conversation := []map[string]string{
+		{"role": "system", "content": "You are a data analysis assistant. Respond ONLY with a Python code block. Use only stdlib. Always print results."},
+	}
+
+	// Multi-turn conversation
+	turns := []string{
+		"Create a list called 'temps' with 12 monthly average temperatures (Celsius) for São Paulo: [22, 23, 22, 20, 18, 17, 16, 18, 19, 20, 21, 22]. Print it.",
+		"Using the 'temps' variable, find the coldest month (1-indexed), hottest month, and the average temperature. Print all three.",
+		"Using 'temps', classify each month as 'hot' (>20), 'warm' (18-20), or 'cool' (<18). Print the classification for each month.",
+	}
+
+	for i, prompt := range turns {
+		fmt.Printf("--- Turn %d ---\n", i+1)
+		fmt.Printf("User: %s\n\n", prompt)
+
+		conversation = append(conversation, map[string]string{"role": "user", "content": prompt})
+
+		code, err := chatLLM(ctx, conversation)
+		if err != nil {
+			fmt.Fprintf(os.Stderr, "LLM error: %v\n", err)
+			os.Exit(1)
+		}
+		fmt.Printf("Code:\n%s\n\n", code)
+
+		exec, err := ci.ExecuteInContext(ctx, codeCtx.ID, "python", code, nil)
+		if err != nil {
+			fmt.Fprintf(os.Stderr, "Execute error: %v\n", err)
+			os.Exit(1)
+		}
+		fmt.Printf("Output:\n%s\n\n", exec.Text())
+
+		conversation = append(conversation, map[string]string{"role": "assistant", "content": "```python\n" + code + "\n```"})
+	}
+
+	ci.DeleteContext(ctx, codeCtx.ID)
+	fmt.Println("Done! All turns completed with persistent state.")
+}
+
+func chatLLM(ctx context.Context, messages []map[string]string) (string, error) {
+	endpoint := os.Getenv("LLM_ENDPOINT")
+	if endpoint == "" {
+		return "", fmt.Errorf("LLM_ENDPOINT not set")
+	}
+	model := os.Getenv("LLM_MODEL")
+	if model == "" {
+		model = "gpt-4o-mini"
+	}
+
+	body, _ := json.Marshal(map[string]any{
+		"model":      model,
+		"messages":   messages,
+		"max_tokens": 1024,
+	})
+	req, _ := http.NewRequestWithContext(ctx, "POST", endpoint+"/chat/completions", bytes.NewReader(body))
+	req.Header.Set("Content-Type", "application/json")
+
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		return "", err
+	}
+	defer resp.Body.Close()
+	data, _ := io.ReadAll(resp.Body)
+
+	var result struct {
+		Choices []struct {
+			Message struct {
+				Content string `json:"content"`
+			} `json:"message"`
+		} `json:"choices"`
+	}
+	json.Unmarshal(data, &result)
+	if len(result.Choices) == 0 {
+		return "", fmt.Errorf("no choices: %s", string(data))
+	}
+
+	text := result.Choices[0].Message.Content
+	if start := strings.Index(text, "```python"); start != -1 {
+		text = text[start+9:]
+		if end := strings.Index(text, "```"); end != -1 {
+			text = text[:end]
+		}
+	}
+	return strings.TrimSpace(text), nil
+}
diff --git a/sdks/sandbox/go/go.mod b/sdks/sandbox/go/go.mod
new file mode 100644
index 00000000..787be601
--- /dev/null
+++ b/sdks/sandbox/go/go.mod
@@ -0,0 +1,9 @@
+module github.com/alibaba/OpenSandbox/sdks/sandbox/go
+
+go 1.24.0
+
+require (
+	github.com/apapsch/go-jsonmerge/v2 v2.0.0 // indirect
+	github.com/google/uuid v1.6.0 // indirect
+	github.com/oapi-codegen/runtime v1.3.1 // indirect
+)
diff --git a/sdks/sandbox/go/go.sum b/sdks/sandbox/go/go.sum
new file mode 100644
index 00000000..06982a0b
--- /dev/null
+++ b/sdks/sandbox/go/go.sum
@@ -0,0 +1,14 @@
+github.com/RaveNoX/go-jsoncommentstrip v1.0.0/go.mod h1:78ihd09MekBnJnxpICcwzCMzGrKSKYe4AqU6PDYYpjk=
+github.com/apapsch/go-jsonmerge/v2 v2.0.0 h1:axGnT1gRIfimI7gJifB699GoE/oq+F2MU7Dml6nw9rQ=
+github.com/apapsch/go-jsonmerge/v2 v2.0.0/go.mod h1:lvDnEdqiQrp0O42VQGgmlKpxL1AP2+08jFMw88y4klk=
+github.com/bmatcuk/doublestar v1.1.1/go.mod h1:UD6OnuiIn0yFxxA2le/rnRU1G4RaI4UvFv1sNto9p6w=
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
+github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/juju/gnuflag v0.0.0-20171113085948-2ce1bb71843d/go.mod h1:2PavIy+JPciBPrBUjwbNvtwB6RQlve+hkpll6QSNmOE=
+github.com/oapi-codegen/runtime v1.3.1 h1:RgDY6J4OGQLbRXhG/Xpt3vSVqYpHQS7hN4m85+5xB9g=
+github.com/oapi-codegen/runtime v1.3.1/go.mod h1:kOdeacKy7t40Rclb1je37ZLFboFxh+YLy0zaPCMibPY=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/spkg/bom v0.0.0-20160624110644-59b7046e48ad/go.mod h1:qLr4V1qq6nMqFKkMo8ZTx3f+BZEkzsRUY10Xsm2mwU0=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
diff --git a/sdks/sandbox/go/opensandbox/api/egress/cfg.yaml b/sdks/sandbox/go/opensandbox/api/egress/cfg.yaml
new file mode 100644
index 00000000..09559fc1
--- /dev/null
+++ b/sdks/sandbox/go/opensandbox/api/egress/cfg.yaml
@@ -0,0 +1,7 @@
+package: egress
+output: gen.go
+generate:
+  models: true
+  client: true
+output-options:
+  name-normalizer: ToCamelCaseWithInitialisms
diff --git a/sdks/sandbox/go/opensandbox/api/egress/gen.go b/sdks/sandbox/go/opensandbox/api/egress/gen.go
new file mode 100644
index 00000000..cc6b29e3
--- /dev/null
+++ b/sdks/sandbox/go/opensandbox/api/egress/gen.go
@@ -0,0 +1,463 @@
+// Package egress provides primitives to interact with the openapi HTTP API.
+//
+// Code generated by github.com/oapi-codegen/oapi-codegen/v2 version v2.6.0 DO NOT EDIT.
+package egress
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"strings"
+)
+
+// Defines values for NetworkPolicyDefaultAction.
+const (
+	NetworkPolicyDefaultActionAllow NetworkPolicyDefaultAction = "allow"
+	NetworkPolicyDefaultActionDeny  NetworkPolicyDefaultAction = "deny"
+)
+
+// Valid indicates whether the value is a known member of the NetworkPolicyDefaultAction enum.
+func (e NetworkPolicyDefaultAction) Valid() bool {
+	switch e {
+	case NetworkPolicyDefaultActionAllow:
+		return true
+	case NetworkPolicyDefaultActionDeny:
+		return true
+	default:
+		return false
+	}
+}
+
+// Defines values for NetworkRuleAction.
+const (
+	NetworkRuleActionAllow NetworkRuleAction = "allow"
+	NetworkRuleActionDeny  NetworkRuleAction = "deny"
+)
+
+// Valid indicates whether the value is a known member of the NetworkRuleAction enum.
+func (e NetworkRuleAction) Valid() bool {
+	switch e {
+	case NetworkRuleActionAllow:
+		return true
+	case NetworkRuleActionDeny:
+		return true
+	default:
+		return false
+	}
+}
+
+// NetworkPolicy Egress network policy matching the sidecar `/policy` request body.
+// If `defaultAction` is omitted, the sidecar defaults to "deny"; passing an empty
+// object or null results in allow-all behavior at startup.
+type NetworkPolicy struct {
+	// DefaultAction Default action when no egress rule matches. Defaults to "deny".
+	DefaultAction *NetworkPolicyDefaultAction `json:"defaultAction,omitempty"`
+
+	// Egress List of egress rules evaluated in order.
+	Egress *[]NetworkRule `json:"egress,omitempty"`
+}
+
+// NetworkPolicyDefaultAction Default action when no egress rule matches. Defaults to "deny".
+type NetworkPolicyDefaultAction string
+
+// NetworkRule defines model for NetworkRule.
+type NetworkRule struct {
+	// Action Whether to allow or deny matching targets.
+	Action NetworkRuleAction `json:"action"`
+
+	// Target FQDN or wildcard domain (e.g., "example.com", "*.example.com").
+	// IP/CIDR not yet supported in the egress MVP.
+	Target string `json:"target"`
+}
+
+// NetworkRuleAction Whether to allow or deny matching targets.
+type NetworkRuleAction string
+
+// PolicyStatusResponse defines model for PolicyStatusResponse.
+type PolicyStatusResponse struct {
+	// EnforcementMode Egress sidecar enforcement backend mode.
+	EnforcementMode *string `json:"enforcementMode,omitempty"`
+
+	// Mode Derived runtime mode for the current policy.
+	Mode *string `json:"mode,omitempty"`
+
+	// Policy Egress network policy matching the sidecar `/policy` request body.
+	// If `defaultAction` is omitted, the sidecar defaults to "deny"; passing an empty
+	// object or null results in allow-all behavior at startup.
+	Policy *NetworkPolicy `json:"policy,omitempty"`
+
+	// Reason Optional human-readable reason when the sidecar returns extra context.
+	Reason *string `json:"reason,omitempty"`
+
+	// Status Operation status reported by the sidecar.
+	Status *string `json:"status,omitempty"`
+}
+
+// PatchPolicyJSONBody defines parameters for PatchPolicy.
+type PatchPolicyJSONBody = []NetworkRule
+
+// PatchPolicyJSONRequestBody defines body for PatchPolicy for application/json ContentType.
+type PatchPolicyJSONRequestBody = PatchPolicyJSONBody
+
+// RequestEditorFn  is the function signature for the RequestEditor callback function
+type RequestEditorFn func(ctx context.Context, req *http.Request) error
+
+// Doer performs HTTP requests.
+//
+// The standard http.Client implements this interface.
+type HttpRequestDoer interface {
+	Do(req *http.Request) (*http.Response, error)
+}
+
+// Client which conforms to the OpenAPI3 specification for this service.
+type Client struct {
+	// The endpoint of the server conforming to this interface, with scheme,
+	// https://api.deepmap.com for example. This can contain a path relative
+	// to the server, such as https://api.deepmap.com/dev-test, and all the
+	// paths in the swagger spec will be appended to the server.
+	Server string
+
+	// Doer for performing requests, typically a *http.Client with any
+	// customized settings, such as certificate chains.
+	Client HttpRequestDoer
+
+	// A list of callbacks for modifying requests which are generated before sending over
+	// the network.
+	RequestEditors []RequestEditorFn
+}
+
+// ClientOption allows setting custom parameters during construction
+type ClientOption func(*Client) error
+
+// Creates a new Client, with reasonable defaults
+func NewClient(server string, opts ...ClientOption) (*Client, error) {
+	// create a client with sane default values
+	client := Client{
+		Server: server,
+	}
+	// mutate client and add all optional params
+	for _, o := range opts {
+		if err := o(&client); err != nil {
+			return nil, err
+		}
+	}
+	// ensure the server URL always has a trailing slash
+	if !strings.HasSuffix(client.Server, "/") {
+		client.Server += "/"
+	}
+	// create httpClient, if not already present
+	if client.Client == nil {
+		client.Client = &http.Client{}
+	}
+	return &client, nil
+}
+
+// WithHTTPClient allows overriding the default Doer, which is
+// automatically created using http.Client. This is useful for tests.
+func WithHTTPClient(doer HttpRequestDoer) ClientOption {
+	return func(c *Client) error {
+		c.Client = doer
+		return nil
+	}
+}
+
+// WithRequestEditorFn allows setting up a callback function, which will be
+// called right before sending the request. This can be used to mutate the request.
+func WithRequestEditorFn(fn RequestEditorFn) ClientOption {
+	return func(c *Client) error {
+		c.RequestEditors = append(c.RequestEditors, fn)
+		return nil
+	}
+}
+
+// The interface specification for the client above.
+type ClientInterface interface {
+	// GetPolicy request
+	GetPolicy(ctx context.Context, reqEditors ...RequestEditorFn) (*http.Response, error)
+
+	// PatchPolicyWithBody request with any body
+	PatchPolicyWithBody(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*http.Response, error)
+
+	PatchPolicy(ctx context.Context, body PatchPolicyJSONRequestBody, reqEditors ...RequestEditorFn) (*http.Response, error)
+}
+
+func (c *Client) GetPolicy(ctx context.Context, reqEditors ...RequestEditorFn) (*http.Response, error) {
+	req, err := NewGetPolicyRequest(c.Server)
+	if err != nil {
+		return nil, err
+	}
+	req = req.WithContext(ctx)
+	if err := c.applyEditors(ctx, req, reqEditors); err != nil {
+		return nil, err
+	}
+	return c.Client.Do(req)
+}
+
+func (c *Client) PatchPolicyWithBody(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*http.Response, error) {
+	req, err := NewPatchPolicyRequestWithBody(c.Server, contentType, body)
+	if err != nil {
+		return nil, err
+	}
+	req = req.WithContext(ctx)
+	if err := c.applyEditors(ctx, req, reqEditors); err != nil {
+		return nil, err
+	}
+	return c.Client.Do(req)
+}
+
+func (c *Client) PatchPolicy(ctx context.Context, body PatchPolicyJSONRequestBody, reqEditors ...RequestEditorFn) (*http.Response, error) {
+	req, err := NewPatchPolicyRequest(c.Server, body)
+	if err != nil {
+		return nil, err
+	}
+	req = req.WithContext(ctx)
+	if err := c.applyEditors(ctx, req, reqEditors); err != nil {
+		return nil, err
+	}
+	return c.Client.Do(req)
+}
+
+// NewGetPolicyRequest generates requests for GetPolicy
+func NewGetPolicyRequest(server string) (*http.Request, error) {
+	var err error
+
+	serverURL, err := url.Parse(server)
+	if err != nil {
+		return nil, err
+	}
+
+	operationPath := fmt.Sprintf("/policy")
+	if operationPath[0] == '/' {
+		operationPath = "." + operationPath
+	}
+
+	queryURL, err := serverURL.Parse(operationPath)
+	if err != nil {
+		return nil, err
+	}
+
+	req, err := http.NewRequest("GET", queryURL.String(), nil)
+	if err != nil {
+		return nil, err
+	}
+
+	return req, nil
+}
+
+// NewPatchPolicyRequest calls the generic PatchPolicy builder with application/json body
+func NewPatchPolicyRequest(server string, body PatchPolicyJSONRequestBody) (*http.Request, error) {
+	var bodyReader io.Reader
+	buf, err := json.Marshal(body)
+	if err != nil {
+		return nil, err
+	}
+	bodyReader = bytes.NewReader(buf)
+	return NewPatchPolicyRequestWithBody(server, "application/json", bodyReader)
+}
+
+// NewPatchPolicyRequestWithBody generates requests for PatchPolicy with any type of body
+func NewPatchPolicyRequestWithBody(server string, contentType string, body io.Reader) (*http.Request, error) {
+	var err error
+
+	serverURL, err := url.Parse(server)
+	if err != nil {
+		return nil, err
+	}
+
+	operationPath := fmt.Sprintf("/policy")
+	if operationPath[0] == '/' {
+		operationPath = "." + operationPath
+	}
+
+	queryURL, err := serverURL.Parse(operationPath)
+	if err != nil {
+		return nil, err
+	}
+
+	req, err := http.NewRequest("PATCH", queryURL.String(), body)
+	if err != nil {
+		return nil, err
+	}
+
+	req.Header.Add("Content-Type", contentType)
+
+	return req, nil
+}
+
+func (c *Client) applyEditors(ctx context.Context, req *http.Request, additionalEditors []RequestEditorFn) error {
+	for _, r := range c.RequestEditors {
+		if err := r(ctx, req); err != nil {
+			return err
+		}
+	}
+	for _, r := range additionalEditors {
+		if err := r(ctx, req); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// ClientWithResponses builds on ClientInterface to offer response payloads
+type ClientWithResponses struct {
+	ClientInterface
+}
+
+// NewClientWithResponses creates a new ClientWithResponses, which wraps
+// Client with return type handling
+func NewClientWithResponses(server string, opts ...ClientOption) (*ClientWithResponses, error) {
+	client, err := NewClient(server, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return &ClientWithResponses{client}, nil
+}
+
+// WithBaseURL overrides the baseURL.
+func WithBaseURL(baseURL string) ClientOption {
+	return func(c *Client) error {
+		newBaseURL, err := url.Parse(baseURL)
+		if err != nil {
+			return err
+		}
+		c.Server = newBaseURL.String()
+		return nil
+	}
+}
+
+// ClientWithResponsesInterface is the interface specification for the client with responses above.
+type ClientWithResponsesInterface interface {
+	// GetPolicyWithResponse request
+	GetPolicyWithResponse(ctx context.Context, reqEditors ...RequestEditorFn) (*GetPolicyResponse, error)
+
+	// PatchPolicyWithBodyWithResponse request with any body
+	PatchPolicyWithBodyWithResponse(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*PatchPolicyResponse, error)
+
+	PatchPolicyWithResponse(ctx context.Context, body PatchPolicyJSONRequestBody, reqEditors ...RequestEditorFn) (*PatchPolicyResponse, error)
+}
+
+type GetPolicyResponse struct {
+	Body         []byte
+	HTTPResponse *http.Response
+	JSON200      *PolicyStatusResponse
+}
+
+// Status returns HTTPResponse.Status
+func (r GetPolicyResponse) Status() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Status
+	}
+	return http.StatusText(0)
+}
+
+// StatusCode returns HTTPResponse.StatusCode
+func (r GetPolicyResponse) StatusCode() int {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.StatusCode
+	}
+	return 0
+}
+
+type PatchPolicyResponse struct {
+	Body         []byte
+	HTTPResponse *http.Response
+	JSON200      *PolicyStatusResponse
+}
+
+// Status returns HTTPResponse.Status
+func (r PatchPolicyResponse) Status() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Status
+	}
+	return http.StatusText(0)
+}
+
+// StatusCode returns HTTPResponse.StatusCode
+func (r PatchPolicyResponse) StatusCode() int {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.StatusCode
+	}
+	return 0
+}
+
+// GetPolicyWithResponse request returning *GetPolicyResponse
+func (c *ClientWithResponses) GetPolicyWithResponse(ctx context.Context, reqEditors ...RequestEditorFn) (*GetPolicyResponse, error) {
+	rsp, err := c.GetPolicy(ctx, reqEditors...)
+	if err != nil {
+		return nil, err
+	}
+	return ParseGetPolicyResponse(rsp)
+}
+
+// PatchPolicyWithBodyWithResponse request with arbitrary body returning *PatchPolicyResponse
+func (c *ClientWithResponses) PatchPolicyWithBodyWithResponse(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*PatchPolicyResponse, error) {
+	rsp, err := c.PatchPolicyWithBody(ctx, contentType, body, reqEditors...)
+	if err != nil {
+		return nil, err
+	}
+	return ParsePatchPolicyResponse(rsp)
+}
+
+func (c *ClientWithResponses) PatchPolicyWithResponse(ctx context.Context, body PatchPolicyJSONRequestBody, reqEditors ...RequestEditorFn) (*PatchPolicyResponse, error) {
+	rsp, err := c.PatchPolicy(ctx, body, reqEditors...)
+	if err != nil {
+		return nil, err
+	}
+	return ParsePatchPolicyResponse(rsp)
+}
+
+// ParseGetPolicyResponse parses an HTTP response from a GetPolicyWithResponse call
+func ParseGetPolicyResponse(rsp *http.Response) (*GetPolicyResponse, error) {
+	bodyBytes, err := io.ReadAll(rsp.Body)
+	defer func() { _ = rsp.Body.Close() }()
+	if err != nil {
+		return nil, err
+	}
+
+	response := &GetPolicyResponse{
+		Body:         bodyBytes,
+		HTTPResponse: rsp,
+	}
+
+	switch {
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 200:
+		var dest PolicyStatusResponse
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON200 = &dest
+
+	}
+
+	return response, nil
+}
+
+// ParsePatchPolicyResponse parses an HTTP response from a PatchPolicyWithResponse call
+func ParsePatchPolicyResponse(rsp *http.Response) (*PatchPolicyResponse, error) {
+	bodyBytes, err := io.ReadAll(rsp.Body)
+	defer func() { _ = rsp.Body.Close() }()
+	if err != nil {
+		return nil, err
+	}
+
+	response := &PatchPolicyResponse{
+		Body:         bodyBytes,
+		HTTPResponse: rsp,
+	}
+
+	switch {
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 200:
+		var dest PolicyStatusResponse
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON200 = &dest
+
+	}
+
+	return response, nil
+}
diff --git a/sdks/sandbox/go/opensandbox/api/egress/generate.go b/sdks/sandbox/go/opensandbox/api/egress/generate.go
new file mode 100644
index 00000000..95e5c8d9
--- /dev/null
+++ b/sdks/sandbox/go/opensandbox/api/egress/generate.go
@@ -0,0 +1,3 @@
+package egress
+
+//go:generate oapi-codegen --config cfg.yaml ../specs/egress-api.yaml
diff --git a/sdks/sandbox/go/opensandbox/api/execd/cfg.yaml b/sdks/sandbox/go/opensandbox/api/execd/cfg.yaml
new file mode 100644
index 00000000..4240f143
--- /dev/null
+++ b/sdks/sandbox/go/opensandbox/api/execd/cfg.yaml
@@ -0,0 +1,7 @@
+package: execd
+output: gen.go
+generate:
+  models: true
+  client: true
+output-options:
+  name-normalizer: ToCamelCaseWithInitialisms
diff --git a/sdks/sandbox/go/opensandbox/api/execd/gen.go b/sdks/sandbox/go/opensandbox/api/execd/gen.go
new file mode 100644
index 00000000..74c07c85
--- /dev/null
+++ b/sdks/sandbox/go/opensandbox/api/execd/gen.go
@@ -0,0 +1,4173 @@
+// Package execd provides primitives to interact with the openapi HTTP API.
+//
+// Code generated by github.com/oapi-codegen/oapi-codegen/v2 version v2.6.0 DO NOT EDIT.
+package execd
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"strings"
+	"time"
+
+	"github.com/oapi-codegen/runtime"
+	openapi_types "github.com/oapi-codegen/runtime/types"
+)
+
+const (
+	AccessTokenScopes = "AccessToken.Scopes"
+)
+
+// Defines values for ServerStreamEventType.
+const (
+	Error             ServerStreamEventType = "error"
+	ExecutionComplete ServerStreamEventType = "execution_complete"
+	ExecutionCount    ServerStreamEventType = "execution_count"
+	Init              ServerStreamEventType = "init"
+	Ping              ServerStreamEventType = "ping"
+	Result            ServerStreamEventType = "result"
+	Status            ServerStreamEventType = "status"
+	Stderr            ServerStreamEventType = "stderr"
+	Stdout            ServerStreamEventType = "stdout"
+)
+
+// Valid indicates whether the value is a known member of the ServerStreamEventType enum.
+func (e ServerStreamEventType) Valid() bool {
+	switch e {
+	case Error:
+		return true
+	case ExecutionComplete:
+		return true
+	case ExecutionCount:
+		return true
+	case Init:
+		return true
+	case Ping:
+		return true
+	case Result:
+		return true
+	case Status:
+		return true
+	case Stderr:
+		return true
+	case Stdout:
+		return true
+	default:
+		return false
+	}
+}
+
+// CodeContext Code execution context with session identifier
+type CodeContext struct {
+	// ID Unique session identifier returned by CreateContext
+	ID *string `json:"id,omitempty"`
+
+	// Language Execution runtime
+	Language string `json:"language"`
+}
+
+// CodeContextRequest Request to create a code execution context
+type CodeContextRequest struct {
+	// Language Execution runtime (python, bash, java, etc.)
+	Language *string `json:"language,omitempty"`
+}
+
+// CommandStatusResponse Command execution status (foreground or background)
+type CommandStatusResponse struct {
+	// Content Original command content
+	Content *string `json:"content,omitempty"`
+
+	// Error Error message if the command failed
+	Error *string `json:"error,omitempty"`
+
+	// ExitCode Exit code if the command has finished
+	ExitCode *int32 `json:"exit_code,omitempty"`
+
+	// FinishedAt Finish time in RFC3339 format (null if still running)
+	FinishedAt *time.Time `json:"finished_at,omitempty"`
+
+	// ID Command ID returned by RunCommand
+	ID *string `json:"id,omitempty"`
+
+	// Running Whether the command is still running
+	Running *bool `json:"running,omitempty"`
+
+	// StartedAt Start time in RFC3339 format
+	StartedAt *time.Time `json:"started_at,omitempty"`
+}
+
+// CreateSessionRequest Request to create a bash session (optional body; empty treated as defaults)
+type CreateSessionRequest struct {
+	// Cwd Working directory for the session (optional)
+	Cwd *string `json:"cwd,omitempty"`
+}
+
+// ErrorResponse Standard error response format
+type ErrorResponse struct {
+	// Code Error code for programmatic handling
+	Code string `json:"code"`
+
+	// Message Human-readable error message
+	Message string `json:"message"`
+}
+
+// FileInfo File metadata including path and permissions
+type FileInfo struct {
+	// CreatedAt File creation time
+	CreatedAt time.Time `json:"created_at"`
+
+	// Group File group name
+	Group string `json:"group"`
+
+	// Mode File permissions in octal format
+	Mode int `json:"mode"`
+
+	// ModifiedAt Last modification time
+	ModifiedAt time.Time `json:"modified_at"`
+
+	// Owner File owner username
+	Owner string `json:"owner"`
+
+	// Path Absolute file path
+	Path string `json:"path"`
+
+	// Size File size in bytes
+	Size int64 `json:"size"`
+}
+
+// Metrics System resource usage metrics
+type Metrics struct {
+	// CPUCount Number of CPU cores
+	CPUCount float32 `json:"cpu_count"`
+
+	// CPUUsedPct CPU usage percentage
+	CPUUsedPct float32 `json:"cpu_used_pct"`
+
+	// MemTotalMib Total memory in MiB
+	MemTotalMib float32 `json:"mem_total_mib"`
+
+	// MemUsedMib Used memory in MiB
+	MemUsedMib float32 `json:"mem_used_mib"`
+
+	// Timestamp Timestamp when metrics were collected (Unix milliseconds)
+	Timestamp int64 `json:"timestamp"`
+}
+
+// Permission File ownership and mode settings
+type Permission struct {
+	// Group Group name
+	Group *string `json:"group,omitempty"`
+
+	// Mode Permission mode in octal format (e.g., 644, 755)
+	Mode int `json:"mode"`
+
+	// Owner Owner username
+	Owner *string `json:"owner,omitempty"`
+}
+
+// RenameFileItem File rename/move operation
+type RenameFileItem struct {
+	// Dest Destination file path
+	Dest string `json:"dest"`
+
+	// Src Source file path
+	Src string `json:"src"`
+}
+
+// ReplaceFileContentItem Content replacement operation
+type ReplaceFileContentItem struct {
+	// New Replacement string
+	New string `json:"new"`
+
+	// Old String to be replaced
+	Old string `json:"old"`
+}
+
+// RunCodeRequest Request to execute code in a context
+type RunCodeRequest struct {
+	// Code Source code to execute
+	Code string `json:"code"`
+
+	// Context Code execution context with session identifier
+	Context *CodeContext `json:"context,omitempty"`
+}
+
+// RunCommandRequest Request to execute a shell command
+type RunCommandRequest struct {
+	// Background Whether to run command in detached mode
+	Background *bool `json:"background,omitempty"`
+
+	// Command Shell command to execute
+	Command string `json:"command"`
+
+	// Cwd Working directory for command execution
+	Cwd *string `json:"cwd,omitempty"`
+
+	// Envs Environment variables injected into the command process.
+	Envs *map[string]string `json:"envs,omitempty"`
+
+	// GID Unix group ID used to run the command. Requires `uid` to be provided.
+	GID *int32 `json:"gid,omitempty"`
+
+	// Timeout Maximum allowed execution time in milliseconds before the command is forcefully terminated by the server. If omitted, the server will not enforce any timeout.
+	Timeout *int64 `json:"timeout,omitempty"`
+
+	// UID Unix user ID used to run the command. If `gid` is provided, `uid` is required.
+	UID *int32 `json:"uid,omitempty"`
+}
+
+// RunInSessionRequest Request to run a command in an existing bash session
+type RunInSessionRequest struct {
+	// Command Shell command to execute in the session
+	Command string `json:"command"`
+
+	// Cwd Working directory override for this run (optional)
+	Cwd *string `json:"cwd,omitempty"`
+
+	// Timeout Maximum execution time in milliseconds (optional; server may not enforce if omitted)
+	Timeout *int64 `json:"timeout,omitempty"`
+}
+
+// ServerStreamEvent Server-sent event for streaming execution output
+type ServerStreamEvent struct {
+	// Error Execution error details if an error occurred
+	Error *struct {
+		// Ename Error name/type
+		Ename *string `json:"ename,omitempty"`
+
+		// Evalue Error value/message
+		Evalue *string `json:"evalue,omitempty"`
+
+		// Traceback Stack trace lines
+		Traceback *[]string `json:"traceback,omitempty"`
+	} `json:"error,omitempty"`
+
+	// ExecutionCount Cell execution number in the session
+	ExecutionCount *int `json:"execution_count,omitempty"`
+
+	// ExecutionTime Execution duration in milliseconds
+	ExecutionTime *int64 `json:"execution_time,omitempty"`
+
+	// Results Execution output in various MIME types (e.g., "text/plain", "text/html")
+	Results *map[string]interface{} `json:"results,omitempty"`
+
+	// Text Textual data for status, init, and stream events
+	Text *string `json:"text,omitempty"`
+
+	// Timestamp When the event was generated (Unix milliseconds)
+	Timestamp *int64 `json:"timestamp,omitempty"`
+
+	// Type Event type for client-side handling
+	Type *ServerStreamEventType `json:"type,omitempty"`
+}
+
+// ServerStreamEventType Event type for client-side handling
+type ServerStreamEventType string
+
+// SessionCreated Response for create_session
+type SessionCreated struct {
+	// SessionID Unique session ID for run_in_session and delete_session
+	SessionID string `json:"session_id"`
+}
+
+// BadRequest Standard error response format
+type BadRequest = ErrorResponse
+
+// InternalServerError Standard error response format
+type InternalServerError = ErrorResponse
+
+// NotFound Standard error response format
+type NotFound = ErrorResponse
+
+// InterruptCodeParams defines parameters for InterruptCode.
+type InterruptCodeParams struct {
+	// ID Session ID of the execution context to interrupt
+	ID string `form:"id" json:"id"`
+}
+
+// DeleteContextsByLanguageParams defines parameters for DeleteContextsByLanguage.
+type DeleteContextsByLanguageParams struct {
+	// Language Target execution runtime whose contexts should be deleted
+	Language string `form:"language" json:"language"`
+}
+
+// ListContextsParams defines parameters for ListContexts.
+type ListContextsParams struct {
+	// Language Filter contexts by execution runtime (python, bash, java, etc.)
+	Language string `form:"language" json:"language"`
+}
+
+// InterruptCommandParams defines parameters for InterruptCommand.
+type InterruptCommandParams struct {
+	// ID Session ID of the execution context to interrupt
+	ID string `form:"id" json:"id"`
+}
+
+// GetBackgroundCommandLogsParams defines parameters for GetBackgroundCommandLogs.
+type GetBackgroundCommandLogsParams struct {
+	// Cursor Optional 0-based line cursor (behaves like a file seek). When provided, only
+	// stdout/stderr lines after this line are returned. The response includes the
+	// latest line index (`cursor`) so the client can request incremental output
+	// on subsequent calls. If omitted, the full log is returned.
+	Cursor *int64 `form:"cursor,omitempty" json:"cursor,omitempty"`
+}
+
+// RemoveDirsParams defines parameters for RemoveDirs.
+type RemoveDirsParams struct {
+	// Path Directory path(s) to delete (can be specified multiple times)
+	Path []string `form:"path" json:"path"`
+}
+
+// MakeDirsJSONBody defines parameters for MakeDirs.
+type MakeDirsJSONBody map[string]Permission
+
+// RemoveFilesParams defines parameters for RemoveFiles.
+type RemoveFilesParams struct {
+	// Path File path(s) to delete (can be specified multiple times)
+	Path []string `form:"path" json:"path"`
+}
+
+// DownloadFileParams defines parameters for DownloadFile.
+type DownloadFileParams struct {
+	// Path Absolute or relative path of the file to download
+	Path string `form:"path" json:"path"`
+
+	// Range HTTP Range header for partial content requests
+	Range *string `json:"Range,omitempty"`
+}
+
+// GetFilesInfoParams defines parameters for GetFilesInfo.
+type GetFilesInfoParams struct {
+	// Path File path(s) to get info for (can be specified multiple times)
+	Path []string `form:"path" json:"path"`
+}
+
+// RenameFilesJSONBody defines parameters for RenameFiles.
+type RenameFilesJSONBody = []RenameFileItem
+
+// ChmodFilesJSONBody defines parameters for ChmodFiles.
+type ChmodFilesJSONBody map[string]Permission
+
+// ReplaceContentJSONBody defines parameters for ReplaceContent.
+type ReplaceContentJSONBody map[string]ReplaceFileContentItem
+
+// SearchFilesParams defines parameters for SearchFiles.
+type SearchFilesParams struct {
+	// Path Root directory path to search in
+	Path string `form:"path" json:"path"`
+
+	// Pattern Glob pattern to match files (default is **)
+	Pattern *string `form:"pattern,omitempty" json:"pattern,omitempty"`
+}
+
+// UploadFileMultipartBody defines parameters for UploadFile.
+type UploadFileMultipartBody struct {
+	// File File to upload
+	File *openapi_types.File `json:"file,omitempty"`
+
+	// Metadata JSON-encoded file metadata (FileMetadata object)
+	Metadata *string `json:"metadata,omitempty"`
+}
+
+// RunCodeJSONRequestBody defines body for RunCode for application/json ContentType.
+type RunCodeJSONRequestBody = RunCodeRequest
+
+// CreateCodeContextJSONRequestBody defines body for CreateCodeContext for application/json ContentType.
+type CreateCodeContextJSONRequestBody = CodeContextRequest
+
+// RunCommandJSONRequestBody defines body for RunCommand for application/json ContentType.
+type RunCommandJSONRequestBody = RunCommandRequest
+
+// MakeDirsJSONRequestBody defines body for MakeDirs for application/json ContentType.
+type MakeDirsJSONRequestBody MakeDirsJSONBody
+
+// RenameFilesJSONRequestBody defines body for RenameFiles for application/json ContentType.
+type RenameFilesJSONRequestBody = RenameFilesJSONBody
+
+// ChmodFilesJSONRequestBody defines body for ChmodFiles for application/json ContentType.
+type ChmodFilesJSONRequestBody ChmodFilesJSONBody
+
+// ReplaceContentJSONRequestBody defines body for ReplaceContent for application/json ContentType.
+type ReplaceContentJSONRequestBody ReplaceContentJSONBody
+
+// UploadFileMultipartRequestBody defines body for UploadFile for multipart/form-data ContentType.
+type UploadFileMultipartRequestBody UploadFileMultipartBody
+
+// CreateSessionJSONRequestBody defines body for CreateSession for application/json ContentType.
+type CreateSessionJSONRequestBody = CreateSessionRequest
+
+// RunInSessionJSONRequestBody defines body for RunInSession for application/json ContentType.
+type RunInSessionJSONRequestBody = RunInSessionRequest
+
+// RequestEditorFn  is the function signature for the RequestEditor callback function
+type RequestEditorFn func(ctx context.Context, req *http.Request) error
+
+// Doer performs HTTP requests.
+//
+// The standard http.Client implements this interface.
+type HttpRequestDoer interface {
+	Do(req *http.Request) (*http.Response, error)
+}
+
+// Client which conforms to the OpenAPI3 specification for this service.
+type Client struct {
+	// The endpoint of the server conforming to this interface, with scheme,
+	// https://api.deepmap.com for example. This can contain a path relative
+	// to the server, such as https://api.deepmap.com/dev-test, and all the
+	// paths in the swagger spec will be appended to the server.
+	Server string
+
+	// Doer for performing requests, typically a *http.Client with any
+	// customized settings, such as certificate chains.
+	Client HttpRequestDoer
+
+	// A list of callbacks for modifying requests which are generated before sending over
+	// the network.
+	RequestEditors []RequestEditorFn
+}
+
+// ClientOption allows setting custom parameters during construction
+type ClientOption func(*Client) error
+
+// Creates a new Client, with reasonable defaults
+func NewClient(server string, opts ...ClientOption) (*Client, error) {
+	// create a client with sane default values
+	client := Client{
+		Server: server,
+	}
+	// mutate client and add all optional params
+	for _, o := range opts {
+		if err := o(&client); err != nil {
+			return nil, err
+		}
+	}
+	// ensure the server URL always has a trailing slash
+	if !strings.HasSuffix(client.Server, "/") {
+		client.Server += "/"
+	}
+	// create httpClient, if not already present
+	if client.Client == nil {
+		client.Client = &http.Client{}
+	}
+	return &client, nil
+}
+
+// WithHTTPClient allows overriding the default Doer, which is
+// automatically created using http.Client. This is useful for tests.
+func WithHTTPClient(doer HttpRequestDoer) ClientOption {
+	return func(c *Client) error {
+		c.Client = doer
+		return nil
+	}
+}
+
+// WithRequestEditorFn allows setting up a callback function, which will be
+// called right before sending the request. This can be used to mutate the request.
+func WithRequestEditorFn(fn RequestEditorFn) ClientOption {
+	return func(c *Client) error {
+		c.RequestEditors = append(c.RequestEditors, fn)
+		return nil
+	}
+}
+
+// The interface specification for the client above.
+type ClientInterface interface {
+	// InterruptCode request
+	InterruptCode(ctx context.Context, params *InterruptCodeParams, reqEditors ...RequestEditorFn) (*http.Response, error)
+
+	// RunCodeWithBody request with any body
+	RunCodeWithBody(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*http.Response, error)
+
+	RunCode(ctx context.Context, body RunCodeJSONRequestBody, reqEditors ...RequestEditorFn) (*http.Response, error)
+
+	// CreateCodeContextWithBody request with any body
+	CreateCodeContextWithBody(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*http.Response, error)
+
+	CreateCodeContext(ctx context.Context, body CreateCodeContextJSONRequestBody, reqEditors ...RequestEditorFn) (*http.Response, error)
+
+	// DeleteContextsByLanguage request
+	DeleteContextsByLanguage(ctx context.Context, params *DeleteContextsByLanguageParams, reqEditors ...RequestEditorFn) (*http.Response, error)
+
+	// ListContexts request
+	ListContexts(ctx context.Context, params *ListContextsParams, reqEditors ...RequestEditorFn) (*http.Response, error)
+
+	// DeleteContext request
+	DeleteContext(ctx context.Context, contextID string, reqEditors ...RequestEditorFn) (*http.Response, error)
+
+	// GetContext request
+	GetContext(ctx context.Context, contextID string, reqEditors ...RequestEditorFn) (*http.Response, error)
+
+	// InterruptCommand request
+	InterruptCommand(ctx context.Context, params *InterruptCommandParams, reqEditors ...RequestEditorFn) (*http.Response, error)
+
+	// RunCommandWithBody request with any body
+	RunCommandWithBody(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*http.Response, error)
+
+	RunCommand(ctx context.Context, body RunCommandJSONRequestBody, reqEditors ...RequestEditorFn) (*http.Response, error)
+
+	// GetCommandStatus request
+	GetCommandStatus(ctx context.Context, id string, reqEditors ...RequestEditorFn) (*http.Response, error)
+
+	// GetBackgroundCommandLogs request
+	GetBackgroundCommandLogs(ctx context.Context, id string, params *GetBackgroundCommandLogsParams, reqEditors ...RequestEditorFn) (*http.Response, error)
+
+	// RemoveDirs request
+	RemoveDirs(ctx context.Context, params *RemoveDirsParams, reqEditors ...RequestEditorFn) (*http.Response, error)
+
+	// MakeDirsWithBody request with any body
+	MakeDirsWithBody(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*http.Response, error)
+
+	MakeDirs(ctx context.Context, body MakeDirsJSONRequestBody, reqEditors ...RequestEditorFn) (*http.Response, error)
+
+	// RemoveFiles request
+	RemoveFiles(ctx context.Context, params *RemoveFilesParams, reqEditors ...RequestEditorFn) (*http.Response, error)
+
+	// DownloadFile request
+	DownloadFile(ctx context.Context, params *DownloadFileParams, reqEditors ...RequestEditorFn) (*http.Response, error)
+
+	// GetFilesInfo request
+	GetFilesInfo(ctx context.Context, params *GetFilesInfoParams, reqEditors ...RequestEditorFn) (*http.Response, error)
+
+	// RenameFilesWithBody request with any body
+	RenameFilesWithBody(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*http.Response, error)
+
+	RenameFiles(ctx context.Context, body RenameFilesJSONRequestBody, reqEditors ...RequestEditorFn) (*http.Response, error)
+
+	// ChmodFilesWithBody request with any body
+	ChmodFilesWithBody(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*http.Response, error)
+
+	ChmodFiles(ctx context.Context, body ChmodFilesJSONRequestBody, reqEditors ...RequestEditorFn) (*http.Response, error)
+
+	// ReplaceContentWithBody request with any body
+	ReplaceContentWithBody(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*http.Response, error)
+
+	ReplaceContent(ctx context.Context, body ReplaceContentJSONRequestBody, reqEditors ...RequestEditorFn) (*http.Response, error)
+
+	// SearchFiles request
+	SearchFiles(ctx context.Context, params *SearchFilesParams, reqEditors ...RequestEditorFn) (*http.Response, error)
+
+	// UploadFileWithBody request with any body
+	UploadFileWithBody(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*http.Response, error)
+
+	// GetMetrics request
+	GetMetrics(ctx context.Context, reqEditors ...RequestEditorFn) (*http.Response, error)
+
+	// WatchMetrics request
+	WatchMetrics(ctx context.Context, reqEditors ...RequestEditorFn) (*http.Response, error)
+
+	// Ping request
+	Ping(ctx context.Context, reqEditors ...RequestEditorFn) (*http.Response, error)
+
+	// CreateSessionWithBody request with any body
+	CreateSessionWithBody(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*http.Response, error)
+
+	CreateSession(ctx context.Context, body CreateSessionJSONRequestBody, reqEditors ...RequestEditorFn) (*http.Response, error)
+
+	// DeleteSession request
+	DeleteSession(ctx context.Context, sessionID string, reqEditors ...RequestEditorFn) (*http.Response, error)
+
+	// RunInSessionWithBody request with any body
+	RunInSessionWithBody(ctx context.Context, sessionID string, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*http.Response, error)
+
+	RunInSession(ctx context.Context, sessionID string, body RunInSessionJSONRequestBody, reqEditors ...RequestEditorFn) (*http.Response, error)
+}
+
+func (c *Client) InterruptCode(ctx context.Context, params *InterruptCodeParams, reqEditors ...RequestEditorFn) (*http.Response, error) {
+	req, err := NewInterruptCodeRequest(c.Server, params)
+	if err != nil {
+		return nil, err
+	}
+	req = req.WithContext(ctx)
+	if err := c.applyEditors(ctx, req, reqEditors); err != nil {
+		return nil, err
+	}
+	return c.Client.Do(req)
+}
+
+func (c *Client) RunCodeWithBody(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*http.Response, error) {
+	req, err := NewRunCodeRequestWithBody(c.Server, contentType, body)
+	if err != nil {
+		return nil, err
+	}
+	req = req.WithContext(ctx)
+	if err := c.applyEditors(ctx, req, reqEditors); err != nil {
+		return nil, err
+	}
+	return c.Client.Do(req)
+}
+
+func (c *Client) RunCode(ctx context.Context, body RunCodeJSONRequestBody, reqEditors ...RequestEditorFn) (*http.Response, error) {
+	req, err := NewRunCodeRequest(c.Server, body)
+	if err != nil {
+		return nil, err
+	}
+	req = req.WithContext(ctx)
+	if err := c.applyEditors(ctx, req, reqEditors); err != nil {
+		return nil, err
+	}
+	return c.Client.Do(req)
+}
+
+func (c *Client) CreateCodeContextWithBody(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*http.Response, error) {
+	req, err := NewCreateCodeContextRequestWithBody(c.Server, contentType, body)
+	if err != nil {
+		return nil, err
+	}
+	req = req.WithContext(ctx)
+	if err := c.applyEditors(ctx, req, reqEditors); err != nil {
+		return nil, err
+	}
+	return c.Client.Do(req)
+}
+
+func (c *Client) CreateCodeContext(ctx context.Context, body CreateCodeContextJSONRequestBody, reqEditors ...RequestEditorFn) (*http.Response, error) {
+	req, err := NewCreateCodeContextRequest(c.Server, body)
+	if err != nil {
+		return nil, err
+	}
+	req = req.WithContext(ctx)
+	if err := c.applyEditors(ctx, req, reqEditors); err != nil {
+		return nil, err
+	}
+	return c.Client.Do(req)
+}
+
+func (c *Client) DeleteContextsByLanguage(ctx context.Context, params *DeleteContextsByLanguageParams, reqEditors ...RequestEditorFn) (*http.Response, error) {
+	req, err := NewDeleteContextsByLanguageRequest(c.Server, params)
+	if err != nil {
+		return nil, err
+	}
+	req = req.WithContext(ctx)
+	if err := c.applyEditors(ctx, req, reqEditors); err != nil {
+		return nil, err
+	}
+	return c.Client.Do(req)
+}
+
+func (c *Client) ListContexts(ctx context.Context, params *ListContextsParams, reqEditors ...RequestEditorFn) (*http.Response, error) {
+	req, err := NewListContextsRequest(c.Server, params)
+	if err != nil {
+		return nil, err
+	}
+	req = req.WithContext(ctx)
+	if err := c.applyEditors(ctx, req, reqEditors); err != nil {
+		return nil, err
+	}
+	return c.Client.Do(req)
+}
+
+func (c *Client) DeleteContext(ctx context.Context, contextID string, reqEditors ...RequestEditorFn) (*http.Response, error) {
+	req, err := NewDeleteContextRequest(c.Server, contextID)
+	if err != nil {
+		return nil, err
+	}
+	req = req.WithContext(ctx)
+	if err := c.applyEditors(ctx, req, reqEditors); err != nil {
+		return nil, err
+	}
+	return c.Client.Do(req)
+}
+
+func (c *Client) GetContext(ctx context.Context, contextID string, reqEditors ...RequestEditorFn) (*http.Response, error) {
+	req, err := NewGetContextRequest(c.Server, contextID)
+	if err != nil {
+		return nil, err
+	}
+	req = req.WithContext(ctx)
+	if err := c.applyEditors(ctx, req, reqEditors); err != nil {
+		return nil, err
+	}
+	return c.Client.Do(req)
+}
+
+func (c *Client) InterruptCommand(ctx context.Context, params *InterruptCommandParams, reqEditors ...RequestEditorFn) (*http.Response, error) {
+	req, err := NewInterruptCommandRequest(c.Server, params)
+	if err != nil {
+		return nil, err
+	}
+	req = req.WithContext(ctx)
+	if err := c.applyEditors(ctx, req, reqEditors); err != nil {
+		return nil, err
+	}
+	return c.Client.Do(req)
+}
+
+func (c *Client) RunCommandWithBody(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*http.Response, error) {
+	req, err := NewRunCommandRequestWithBody(c.Server, contentType, body)
+	if err != nil {
+		return nil, err
+	}
+	req = req.WithContext(ctx)
+	if err := c.applyEditors(ctx, req, reqEditors); err != nil {
+		return nil, err
+	}
+	return c.Client.Do(req)
+}
+
+func (c *Client) RunCommand(ctx context.Context, body RunCommandJSONRequestBody, reqEditors ...RequestEditorFn) (*http.Response, error) {
+	req, err := NewRunCommandRequest(c.Server, body)
+	if err != nil {
+		return nil, err
+	}
+	req = req.WithContext(ctx)
+	if err := c.applyEditors(ctx, req, reqEditors); err != nil {
+		return nil, err
+	}
+	return c.Client.Do(req)
+}
+
+func (c *Client) GetCommandStatus(ctx context.Context, id string, reqEditors ...RequestEditorFn) (*http.Response, error) {
+	req, err := NewGetCommandStatusRequest(c.Server, id)
+	if err != nil {
+		return nil, err
+	}
+	req = req.WithContext(ctx)
+	if err := c.applyEditors(ctx, req, reqEditors); err != nil {
+		return nil, err
+	}
+	return c.Client.Do(req)
+}
+
+func (c *Client) GetBackgroundCommandLogs(ctx context.Context, id string, params *GetBackgroundCommandLogsParams, reqEditors ...RequestEditorFn) (*http.Response, error) {
+	req, err := NewGetBackgroundCommandLogsRequest(c.Server, id, params)
+	if err != nil {
+		return nil, err
+	}
+	req = req.WithContext(ctx)
+	if err := c.applyEditors(ctx, req, reqEditors); err != nil {
+		return nil, err
+	}
+	return c.Client.Do(req)
+}
+
+func (c *Client) RemoveDirs(ctx context.Context, params *RemoveDirsParams, reqEditors ...RequestEditorFn) (*http.Response, error) {
+	req, err := NewRemoveDirsRequest(c.Server, params)
+	if err != nil {
+		return nil, err
+	}
+	req = req.WithContext(ctx)
+	if err := c.applyEditors(ctx, req, reqEditors); err != nil {
+		return nil, err
+	}
+	return c.Client.Do(req)
+}
+
+func (c *Client) MakeDirsWithBody(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*http.Response, error) {
+	req, err := NewMakeDirsRequestWithBody(c.Server, contentType, body)
+	if err != nil {
+		return nil, err
+	}
+	req = req.WithContext(ctx)
+	if err := c.applyEditors(ctx, req, reqEditors); err != nil {
+		return nil, err
+	}
+	return c.Client.Do(req)
+}
+
+func (c *Client) MakeDirs(ctx context.Context, body MakeDirsJSONRequestBody, reqEditors ...RequestEditorFn) (*http.Response, error) {
+	req, err := NewMakeDirsRequest(c.Server, body)
+	if err != nil {
+		return nil, err
+	}
+	req = req.WithContext(ctx)
+	if err := c.applyEditors(ctx, req, reqEditors); err != nil {
+		return nil, err
+	}
+	return c.Client.Do(req)
+}
+
+func (c *Client) RemoveFiles(ctx context.Context, params *RemoveFilesParams, reqEditors ...RequestEditorFn) (*http.Response, error) {
+	req, err := NewRemoveFilesRequest(c.Server, params)
+	if err != nil {
+		return nil, err
+	}
+	req = req.WithContext(ctx)
+	if err := c.applyEditors(ctx, req, reqEditors); err != nil {
+		return nil, err
+	}
+	return c.Client.Do(req)
+}
+
+func (c *Client) DownloadFile(ctx context.Context, params *DownloadFileParams, reqEditors ...RequestEditorFn) (*http.Response, error) {
+	req, err := NewDownloadFileRequest(c.Server, params)
+	if err != nil {
+		return nil, err
+	}
+	req = req.WithContext(ctx)
+	if err := c.applyEditors(ctx, req, reqEditors); err != nil {
+		return nil, err
+	}
+	return c.Client.Do(req)
+}
+
+func (c *Client) GetFilesInfo(ctx context.Context, params *GetFilesInfoParams, reqEditors ...RequestEditorFn) (*http.Response, error) {
+	req, err := NewGetFilesInfoRequest(c.Server, params)
+	if err != nil {
+		return nil, err
+	}
+	req = req.WithContext(ctx)
+	if err := c.applyEditors(ctx, req, reqEditors); err != nil {
+		return nil, err
+	}
+	return c.Client.Do(req)
+}
+
+func (c *Client) RenameFilesWithBody(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*http.Response, error) {
+	req, err := NewRenameFilesRequestWithBody(c.Server, contentType, body)
+	if err != nil {
+		return nil, err
+	}
+	req = req.WithContext(ctx)
+	if err := c.applyEditors(ctx, req, reqEditors); err != nil {
+		return nil, err
+	}
+	return c.Client.Do(req)
+}
+
+func (c *Client) RenameFiles(ctx context.Context, body RenameFilesJSONRequestBody, reqEditors ...RequestEditorFn) (*http.Response, error) {
+	req, err := NewRenameFilesRequest(c.Server, body)
+	if err != nil {
+		return nil, err
+	}
+	req = req.WithContext(ctx)
+	if err := c.applyEditors(ctx, req, reqEditors); err != nil {
+		return nil, err
+	}
+	return c.Client.Do(req)
+}
+
+func (c *Client) ChmodFilesWithBody(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*http.Response, error) {
+	req, err := NewChmodFilesRequestWithBody(c.Server, contentType, body)
+	if err != nil {
+		return nil, err
+	}
+	req = req.WithContext(ctx)
+	if err := c.applyEditors(ctx, req, reqEditors); err != nil {
+		return nil, err
+	}
+	return c.Client.Do(req)
+}
+
+func (c *Client) ChmodFiles(ctx context.Context, body ChmodFilesJSONRequestBody, reqEditors ...RequestEditorFn) (*http.Response, error) {
+	req, err := NewChmodFilesRequest(c.Server, body)
+	if err != nil {
+		return nil, err
+	}
+	req = req.WithContext(ctx)
+	if err := c.applyEditors(ctx, req, reqEditors); err != nil {
+		return nil, err
+	}
+	return c.Client.Do(req)
+}
+
+func (c *Client) ReplaceContentWithBody(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*http.Response, error) {
+	req, err := NewReplaceContentRequestWithBody(c.Server, contentType, body)
+	if err != nil {
+		return nil, err
+	}
+	req = req.WithContext(ctx)
+	if err := c.applyEditors(ctx, req, reqEditors); err != nil {
+		return nil, err
+	}
+	return c.Client.Do(req)
+}
+
+func (c *Client) ReplaceContent(ctx context.Context, body ReplaceContentJSONRequestBody, reqEditors ...RequestEditorFn) (*http.Response, error) {
+	req, err := NewReplaceContentRequest(c.Server, body)
+	if err != nil {
+		return nil, err
+	}
+	req = req.WithContext(ctx)
+	if err := c.applyEditors(ctx, req, reqEditors); err != nil {
+		return nil, err
+	}
+	return c.Client.Do(req)
+}
+
+func (c *Client) SearchFiles(ctx context.Context, params *SearchFilesParams, reqEditors ...RequestEditorFn) (*http.Response, error) {
+	req, err := NewSearchFilesRequest(c.Server, params)
+	if err != nil {
+		return nil, err
+	}
+	req = req.WithContext(ctx)
+	if err := c.applyEditors(ctx, req, reqEditors); err != nil {
+		return nil, err
+	}
+	return c.Client.Do(req)
+}
+
+func (c *Client) UploadFileWithBody(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*http.Response, error) {
+	req, err := NewUploadFileRequestWithBody(c.Server, contentType, body)
+	if err != nil {
+		return nil, err
+	}
+	req = req.WithContext(ctx)
+	if err := c.applyEditors(ctx, req, reqEditors); err != nil {
+		return nil, err
+	}
+	return c.Client.Do(req)
+}
+
+func (c *Client) GetMetrics(ctx context.Context, reqEditors ...RequestEditorFn) (*http.Response, error) {
+	req, err := NewGetMetricsRequest(c.Server)
+	if err != nil {
+		return nil, err
+	}
+	req = req.WithContext(ctx)
+	if err := c.applyEditors(ctx, req, reqEditors); err != nil {
+		return nil, err
+	}
+	return c.Client.Do(req)
+}
+
+func (c *Client) WatchMetrics(ctx context.Context, reqEditors ...RequestEditorFn) (*http.Response, error) {
+	req, err := NewWatchMetricsRequest(c.Server)
+	if err != nil {
+		return nil, err
+	}
+	req = req.WithContext(ctx)
+	if err := c.applyEditors(ctx, req, reqEditors); err != nil {
+		return nil, err
+	}
+	return c.Client.Do(req)
+}
+
+func (c *Client) Ping(ctx context.Context, reqEditors ...RequestEditorFn) (*http.Response, error) {
+	req, err := NewPingRequest(c.Server)
+	if err != nil {
+		return nil, err
+	}
+	req = req.WithContext(ctx)
+	if err := c.applyEditors(ctx, req, reqEditors); err != nil {
+		return nil, err
+	}
+	return c.Client.Do(req)
+}
+
+func (c *Client) CreateSessionWithBody(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*http.Response, error) {
+	req, err := NewCreateSessionRequestWithBody(c.Server, contentType, body)
+	if err != nil {
+		return nil, err
+	}
+	req = req.WithContext(ctx)
+	if err := c.applyEditors(ctx, req, reqEditors); err != nil {
+		return nil, err
+	}
+	return c.Client.Do(req)
+}
+
+func (c *Client) CreateSession(ctx context.Context, body CreateSessionJSONRequestBody, reqEditors ...RequestEditorFn) (*http.Response, error) {
+	req, err := NewCreateSessionRequest(c.Server, body)
+	if err != nil {
+		return nil, err
+	}
+	req = req.WithContext(ctx)
+	if err := c.applyEditors(ctx, req, reqEditors); err != nil {
+		return nil, err
+	}
+	return c.Client.Do(req)
+}
+
+func (c *Client) DeleteSession(ctx context.Context, sessionID string, reqEditors ...RequestEditorFn) (*http.Response, error) {
+	req, err := NewDeleteSessionRequest(c.Server, sessionID)
+	if err != nil {
+		return nil, err
+	}
+	req = req.WithContext(ctx)
+	if err := c.applyEditors(ctx, req, reqEditors); err != nil {
+		return nil, err
+	}
+	return c.Client.Do(req)
+}
+
+func (c *Client) RunInSessionWithBody(ctx context.Context, sessionID string, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*http.Response, error) {
+	req, err := NewRunInSessionRequestWithBody(c.Server, sessionID, contentType, body)
+	if err != nil {
+		return nil, err
+	}
+	req = req.WithContext(ctx)
+	if err := c.applyEditors(ctx, req, reqEditors); err != nil {
+		return nil, err
+	}
+	return c.Client.Do(req)
+}
+
+func (c *Client) RunInSession(ctx context.Context, sessionID string, body RunInSessionJSONRequestBody, reqEditors ...RequestEditorFn) (*http.Response, error) {
+	req, err := NewRunInSessionRequest(c.Server, sessionID, body)
+	if err != nil {
+		return nil, err
+	}
+	req = req.WithContext(ctx)
+	if err := c.applyEditors(ctx, req, reqEditors); err != nil {
+		return nil, err
+	}
+	return c.Client.Do(req)
+}
+
+// NewInterruptCodeRequest generates requests for InterruptCode
+func NewInterruptCodeRequest(server string, params *InterruptCodeParams) (*http.Request, error) {
+	var err error
+
+	serverURL, err := url.Parse(server)
+	if err != nil {
+		return nil, err
+	}
+
+	operationPath := fmt.Sprintf("/code")
+	if operationPath[0] == '/' {
+		operationPath = "." + operationPath
+	}
+
+	queryURL, err := serverURL.Parse(operationPath)
+	if err != nil {
+		return nil, err
+	}
+
+	if params != nil {
+		queryValues := queryURL.Query()
+
+		if queryFrag, err := runtime.StyleParamWithOptions("form", true, "id", params.ID, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "string", Format: ""}); err != nil {
+			return nil, err
+		} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+			return nil, err
+		} else {
+			for k, v := range parsed {
+				for _, v2 := range v {
+					queryValues.Add(k, v2)
+				}
+			}
+		}
+
+		queryURL.RawQuery = queryValues.Encode()
+	}
+
+	req, err := http.NewRequest("DELETE", queryURL.String(), nil)
+	if err != nil {
+		return nil, err
+	}
+
+	return req, nil
+}
+
+// NewRunCodeRequest calls the generic RunCode builder with application/json body
+func NewRunCodeRequest(server string, body RunCodeJSONRequestBody) (*http.Request, error) {
+	var bodyReader io.Reader
+	buf, err := json.Marshal(body)
+	if err != nil {
+		return nil, err
+	}
+	bodyReader = bytes.NewReader(buf)
+	return NewRunCodeRequestWithBody(server, "application/json", bodyReader)
+}
+
+// NewRunCodeRequestWithBody generates requests for RunCode with any type of body
+func NewRunCodeRequestWithBody(server string, contentType string, body io.Reader) (*http.Request, error) {
+	var err error
+
+	serverURL, err := url.Parse(server)
+	if err != nil {
+		return nil, err
+	}
+
+	operationPath := fmt.Sprintf("/code")
+	if operationPath[0] == '/' {
+		operationPath = "." + operationPath
+	}
+
+	queryURL, err := serverURL.Parse(operationPath)
+	if err != nil {
+		return nil, err
+	}
+
+	req, err := http.NewRequest("POST", queryURL.String(), body)
+	if err != nil {
+		return nil, err
+	}
+
+	req.Header.Add("Content-Type", contentType)
+
+	return req, nil
+}
+
+// NewCreateCodeContextRequest calls the generic CreateCodeContext builder with application/json body
+func NewCreateCodeContextRequest(server string, body CreateCodeContextJSONRequestBody) (*http.Request, error) {
+	var bodyReader io.Reader
+	buf, err := json.Marshal(body)
+	if err != nil {
+		return nil, err
+	}
+	bodyReader = bytes.NewReader(buf)
+	return NewCreateCodeContextRequestWithBody(server, "application/json", bodyReader)
+}
+
+// NewCreateCodeContextRequestWithBody generates requests for CreateCodeContext with any type of body
+func NewCreateCodeContextRequestWithBody(server string, contentType string, body io.Reader) (*http.Request, error) {
+	var err error
+
+	serverURL, err := url.Parse(server)
+	if err != nil {
+		return nil, err
+	}
+
+	operationPath := fmt.Sprintf("/code/context")
+	if operationPath[0] == '/' {
+		operationPath = "." + operationPath
+	}
+
+	queryURL, err := serverURL.Parse(operationPath)
+	if err != nil {
+		return nil, err
+	}
+
+	req, err := http.NewRequest("POST", queryURL.String(), body)
+	if err != nil {
+		return nil, err
+	}
+
+	req.Header.Add("Content-Type", contentType)
+
+	return req, nil
+}
+
+// NewDeleteContextsByLanguageRequest generates requests for DeleteContextsByLanguage
+func NewDeleteContextsByLanguageRequest(server string, params *DeleteContextsByLanguageParams) (*http.Request, error) {
+	var err error
+
+	serverURL, err := url.Parse(server)
+	if err != nil {
+		return nil, err
+	}
+
+	operationPath := fmt.Sprintf("/code/contexts")
+	if operationPath[0] == '/' {
+		operationPath = "." + operationPath
+	}
+
+	queryURL, err := serverURL.Parse(operationPath)
+	if err != nil {
+		return nil, err
+	}
+
+	if params != nil {
+		queryValues := queryURL.Query()
+
+		if queryFrag, err := runtime.StyleParamWithOptions("form", true, "language", params.Language, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "string", Format: ""}); err != nil {
+			return nil, err
+		} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+			return nil, err
+		} else {
+			for k, v := range parsed {
+				for _, v2 := range v {
+					queryValues.Add(k, v2)
+				}
+			}
+		}
+
+		queryURL.RawQuery = queryValues.Encode()
+	}
+
+	req, err := http.NewRequest("DELETE", queryURL.String(), nil)
+	if err != nil {
+		return nil, err
+	}
+
+	return req, nil
+}
+
+// NewListContextsRequest generates requests for ListContexts
+func NewListContextsRequest(server string, params *ListContextsParams) (*http.Request, error) {
+	var err error
+
+	serverURL, err := url.Parse(server)
+	if err != nil {
+		return nil, err
+	}
+
+	operationPath := fmt.Sprintf("/code/contexts")
+	if operationPath[0] == '/' {
+		operationPath = "." + operationPath
+	}
+
+	queryURL, err := serverURL.Parse(operationPath)
+	if err != nil {
+		return nil, err
+	}
+
+	if params != nil {
+		queryValues := queryURL.Query()
+
+		if queryFrag, err := runtime.StyleParamWithOptions("form", true, "language", params.Language, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "string", Format: ""}); err != nil {
+			return nil, err
+		} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+			return nil, err
+		} else {
+			for k, v := range parsed {
+				for _, v2 := range v {
+					queryValues.Add(k, v2)
+				}
+			}
+		}
+
+		queryURL.RawQuery = queryValues.Encode()
+	}
+
+	req, err := http.NewRequest("GET", queryURL.String(), nil)
+	if err != nil {
+		return nil, err
+	}
+
+	return req, nil
+}
+
+// NewDeleteContextRequest generates requests for DeleteContext
+func NewDeleteContextRequest(server string, contextID string) (*http.Request, error) {
+	var err error
+
+	var pathParam0 string
+
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "context_id", contextID, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
+	if err != nil {
+		return nil, err
+	}
+
+	serverURL, err := url.Parse(server)
+	if err != nil {
+		return nil, err
+	}
+
+	operationPath := fmt.Sprintf("/code/contexts/%s", pathParam0)
+	if operationPath[0] == '/' {
+		operationPath = "." + operationPath
+	}
+
+	queryURL, err := serverURL.Parse(operationPath)
+	if err != nil {
+		return nil, err
+	}
+
+	req, err := http.NewRequest("DELETE", queryURL.String(), nil)
+	if err != nil {
+		return nil, err
+	}
+
+	return req, nil
+}
+
+// NewGetContextRequest generates requests for GetContext
+func NewGetContextRequest(server string, contextID string) (*http.Request, error) {
+	var err error
+
+	var pathParam0 string
+
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "context_id", contextID, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
+	if err != nil {
+		return nil, err
+	}
+
+	serverURL, err := url.Parse(server)
+	if err != nil {
+		return nil, err
+	}
+
+	operationPath := fmt.Sprintf("/code/contexts/%s", pathParam0)
+	if operationPath[0] == '/' {
+		operationPath = "." + operationPath
+	}
+
+	queryURL, err := serverURL.Parse(operationPath)
+	if err != nil {
+		return nil, err
+	}
+
+	req, err := http.NewRequest("GET", queryURL.String(), nil)
+	if err != nil {
+		return nil, err
+	}
+
+	return req, nil
+}
+
+// NewInterruptCommandRequest generates requests for InterruptCommand
+func NewInterruptCommandRequest(server string, params *InterruptCommandParams) (*http.Request, error) {
+	var err error
+
+	serverURL, err := url.Parse(server)
+	if err != nil {
+		return nil, err
+	}
+
+	operationPath := fmt.Sprintf("/command")
+	if operationPath[0] == '/' {
+		operationPath = "." + operationPath
+	}
+
+	queryURL, err := serverURL.Parse(operationPath)
+	if err != nil {
+		return nil, err
+	}
+
+	if params != nil {
+		queryValues := queryURL.Query()
+
+		if queryFrag, err := runtime.StyleParamWithOptions("form", true, "id", params.ID, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "string", Format: ""}); err != nil {
+			return nil, err
+		} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+			return nil, err
+		} else {
+			for k, v := range parsed {
+				for _, v2 := range v {
+					queryValues.Add(k, v2)
+				}
+			}
+		}
+
+		queryURL.RawQuery = queryValues.Encode()
+	}
+
+	req, err := http.NewRequest("DELETE", queryURL.String(), nil)
+	if err != nil {
+		return nil, err
+	}
+
+	return req, nil
+}
+
+// NewRunCommandRequest calls the generic RunCommand builder with application/json body
+func NewRunCommandRequest(server string, body RunCommandJSONRequestBody) (*http.Request, error) {
+	var bodyReader io.Reader
+	buf, err := json.Marshal(body)
+	if err != nil {
+		return nil, err
+	}
+	bodyReader = bytes.NewReader(buf)
+	return NewRunCommandRequestWithBody(server, "application/json", bodyReader)
+}
+
+// NewRunCommandRequestWithBody generates requests for RunCommand with any type of body
+func NewRunCommandRequestWithBody(server string, contentType string, body io.Reader) (*http.Request, error) {
+	var err error
+
+	serverURL, err := url.Parse(server)
+	if err != nil {
+		return nil, err
+	}
+
+	operationPath := fmt.Sprintf("/command")
+	if operationPath[0] == '/' {
+		operationPath = "." + operationPath
+	}
+
+	queryURL, err := serverURL.Parse(operationPath)
+	if err != nil {
+		return nil, err
+	}
+
+	req, err := http.NewRequest("POST", queryURL.String(), body)
+	if err != nil {
+		return nil, err
+	}
+
+	req.Header.Add("Content-Type", contentType)
+
+	return req, nil
+}
+
+// NewGetCommandStatusRequest generates requests for GetCommandStatus
+func NewGetCommandStatusRequest(server string, id string) (*http.Request, error) {
+	var err error
+
+	var pathParam0 string
+
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "id", id, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
+	if err != nil {
+		return nil, err
+	}
+
+	serverURL, err := url.Parse(server)
+	if err != nil {
+		return nil, err
+	}
+
+	operationPath := fmt.Sprintf("/command/status/%s", pathParam0)
+	if operationPath[0] == '/' {
+		operationPath = "." + operationPath
+	}
+
+	queryURL, err := serverURL.Parse(operationPath)
+	if err != nil {
+		return nil, err
+	}
+
+	req, err := http.NewRequest("GET", queryURL.String(), nil)
+	if err != nil {
+		return nil, err
+	}
+
+	return req, nil
+}
+
+// NewGetBackgroundCommandLogsRequest generates requests for GetBackgroundCommandLogs
+func NewGetBackgroundCommandLogsRequest(server string, id string, params *GetBackgroundCommandLogsParams) (*http.Request, error) {
+	var err error
+
+	var pathParam0 string
+
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "id", id, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
+	if err != nil {
+		return nil, err
+	}
+
+	serverURL, err := url.Parse(server)
+	if err != nil {
+		return nil, err
+	}
+
+	operationPath := fmt.Sprintf("/command/%s/logs", pathParam0)
+	if operationPath[0] == '/' {
+		operationPath = "." + operationPath
+	}
+
+	queryURL, err := serverURL.Parse(operationPath)
+	if err != nil {
+		return nil, err
+	}
+
+	if params != nil {
+		queryValues := queryURL.Query()
+
+		if params.Cursor != nil {
+
+			if queryFrag, err := runtime.StyleParamWithOptions("form", true, "cursor", *params.Cursor, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "integer", Format: "int64"}); err != nil {
+				return nil, err
+			} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+				return nil, err
+			} else {
+				for k, v := range parsed {
+					for _, v2 := range v {
+						queryValues.Add(k, v2)
+					}
+				}
+			}
+
+		}
+
+		queryURL.RawQuery = queryValues.Encode()
+	}
+
+	req, err := http.NewRequest("GET", queryURL.String(), nil)
+	if err != nil {
+		return nil, err
+	}
+
+	return req, nil
+}
+
+// NewRemoveDirsRequest generates requests for RemoveDirs
+func NewRemoveDirsRequest(server string, params *RemoveDirsParams) (*http.Request, error) {
+	var err error
+
+	serverURL, err := url.Parse(server)
+	if err != nil {
+		return nil, err
+	}
+
+	operationPath := fmt.Sprintf("/directories")
+	if operationPath[0] == '/' {
+		operationPath = "." + operationPath
+	}
+
+	queryURL, err := serverURL.Parse(operationPath)
+	if err != nil {
+		return nil, err
+	}
+
+	if params != nil {
+		queryValues := queryURL.Query()
+
+		if params.Path != nil {
+
+			if queryFrag, err := runtime.StyleParamWithOptions("form", true, "path", params.Path, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "array", Format: ""}); err != nil {
+				return nil, err
+			} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+				return nil, err
+			} else {
+				for k, v := range parsed {
+					for _, v2 := range v {
+						queryValues.Add(k, v2)
+					}
+				}
+			}
+
+		}
+
+		queryURL.RawQuery = queryValues.Encode()
+	}
+
+	req, err := http.NewRequest("DELETE", queryURL.String(), nil)
+	if err != nil {
+		return nil, err
+	}
+
+	return req, nil
+}
+
+// NewMakeDirsRequest calls the generic MakeDirs builder with application/json body
+func NewMakeDirsRequest(server string, body MakeDirsJSONRequestBody) (*http.Request, error) {
+	var bodyReader io.Reader
+	buf, err := json.Marshal(body)
+	if err != nil {
+		return nil, err
+	}
+	bodyReader = bytes.NewReader(buf)
+	return NewMakeDirsRequestWithBody(server, "application/json", bodyReader)
+}
+
+// NewMakeDirsRequestWithBody generates requests for MakeDirs with any type of body
+func NewMakeDirsRequestWithBody(server string, contentType string, body io.Reader) (*http.Request, error) {
+	var err error
+
+	serverURL, err := url.Parse(server)
+	if err != nil {
+		return nil, err
+	}
+
+	operationPath := fmt.Sprintf("/directories")
+	if operationPath[0] == '/' {
+		operationPath = "." + operationPath
+	}
+
+	queryURL, err := serverURL.Parse(operationPath)
+	if err != nil {
+		return nil, err
+	}
+
+	req, err := http.NewRequest("POST", queryURL.String(), body)
+	if err != nil {
+		return nil, err
+	}
+
+	req.Header.Add("Content-Type", contentType)
+
+	return req, nil
+}
+
+// NewRemoveFilesRequest generates requests for RemoveFiles
+func NewRemoveFilesRequest(server string, params *RemoveFilesParams) (*http.Request, error) {
+	var err error
+
+	serverURL, err := url.Parse(server)
+	if err != nil {
+		return nil, err
+	}
+
+	operationPath := fmt.Sprintf("/files")
+	if operationPath[0] == '/' {
+		operationPath = "." + operationPath
+	}
+
+	queryURL, err := serverURL.Parse(operationPath)
+	if err != nil {
+		return nil, err
+	}
+
+	if params != nil {
+		queryValues := queryURL.Query()
+
+		if params.Path != nil {
+
+			if queryFrag, err := runtime.StyleParamWithOptions("form", true, "path", params.Path, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "array", Format: ""}); err != nil {
+				return nil, err
+			} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+				return nil, err
+			} else {
+				for k, v := range parsed {
+					for _, v2 := range v {
+						queryValues.Add(k, v2)
+					}
+				}
+			}
+
+		}
+
+		queryURL.RawQuery = queryValues.Encode()
+	}
+
+	req, err := http.NewRequest("DELETE", queryURL.String(), nil)
+	if err != nil {
+		return nil, err
+	}
+
+	return req, nil
+}
+
+// NewDownloadFileRequest generates requests for DownloadFile
+func NewDownloadFileRequest(server string, params *DownloadFileParams) (*http.Request, error) {
+	var err error
+
+	serverURL, err := url.Parse(server)
+	if err != nil {
+		return nil, err
+	}
+
+	operationPath := fmt.Sprintf("/files/download")
+	if operationPath[0] == '/' {
+		operationPath = "." + operationPath
+	}
+
+	queryURL, err := serverURL.Parse(operationPath)
+	if err != nil {
+		return nil, err
+	}
+
+	if params != nil {
+		queryValues := queryURL.Query()
+
+		if queryFrag, err := runtime.StyleParamWithOptions("form", true, "path", params.Path, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "string", Format: ""}); err != nil {
+			return nil, err
+		} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+			return nil, err
+		} else {
+			for k, v := range parsed {
+				for _, v2 := range v {
+					queryValues.Add(k, v2)
+				}
+			}
+		}
+
+		queryURL.RawQuery = queryValues.Encode()
+	}
+
+	req, err := http.NewRequest("GET", queryURL.String(), nil)
+	if err != nil {
+		return nil, err
+	}
+
+	if params != nil {
+
+		if params.Range != nil {
+			var headerParam0 string
+
+			headerParam0, err = runtime.StyleParamWithOptions("simple", false, "Range", *params.Range, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationHeader, Type: "string", Format: ""})
+			if err != nil {
+				return nil, err
+			}
+
+			req.Header.Set("Range", headerParam0)
+		}
+
+	}
+
+	return req, nil
+}
+
+// NewGetFilesInfoRequest generates requests for GetFilesInfo
+func NewGetFilesInfoRequest(server string, params *GetFilesInfoParams) (*http.Request, error) {
+	var err error
+
+	serverURL, err := url.Parse(server)
+	if err != nil {
+		return nil, err
+	}
+
+	operationPath := fmt.Sprintf("/files/info")
+	if operationPath[0] == '/' {
+		operationPath = "." + operationPath
+	}
+
+	queryURL, err := serverURL.Parse(operationPath)
+	if err != nil {
+		return nil, err
+	}
+
+	if params != nil {
+		queryValues := queryURL.Query()
+
+		if params.Path != nil {
+
+			if queryFrag, err := runtime.StyleParamWithOptions("form", true, "path", params.Path, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "array", Format: ""}); err != nil {
+				return nil, err
+			} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+				return nil, err
+			} else {
+				for k, v := range parsed {
+					for _, v2 := range v {
+						queryValues.Add(k, v2)
+					}
+				}
+			}
+
+		}
+
+		queryURL.RawQuery = queryValues.Encode()
+	}
+
+	req, err := http.NewRequest("GET", queryURL.String(), nil)
+	if err != nil {
+		return nil, err
+	}
+
+	return req, nil
+}
+
+// NewRenameFilesRequest calls the generic RenameFiles builder with application/json body
+func NewRenameFilesRequest(server string, body RenameFilesJSONRequestBody) (*http.Request, error) {
+	var bodyReader io.Reader
+	buf, err := json.Marshal(body)
+	if err != nil {
+		return nil, err
+	}
+	bodyReader = bytes.NewReader(buf)
+	return NewRenameFilesRequestWithBody(server, "application/json", bodyReader)
+}
+
+// NewRenameFilesRequestWithBody generates requests for RenameFiles with any type of body
+func NewRenameFilesRequestWithBody(server string, contentType string, body io.Reader) (*http.Request, error) {
+	var err error
+
+	serverURL, err := url.Parse(server)
+	if err != nil {
+		return nil, err
+	}
+
+	operationPath := fmt.Sprintf("/files/mv")
+	if operationPath[0] == '/' {
+		operationPath = "." + operationPath
+	}
+
+	queryURL, err := serverURL.Parse(operationPath)
+	if err != nil {
+		return nil, err
+	}
+
+	req, err := http.NewRequest("POST", queryURL.String(), body)
+	if err != nil {
+		return nil, err
+	}
+
+	req.Header.Add("Content-Type", contentType)
+
+	return req, nil
+}
+
+// NewChmodFilesRequest calls the generic ChmodFiles builder with application/json body
+func NewChmodFilesRequest(server string, body ChmodFilesJSONRequestBody) (*http.Request, error) {
+	var bodyReader io.Reader
+	buf, err := json.Marshal(body)
+	if err != nil {
+		return nil, err
+	}
+	bodyReader = bytes.NewReader(buf)
+	return NewChmodFilesRequestWithBody(server, "application/json", bodyReader)
+}
+
+// NewChmodFilesRequestWithBody generates requests for ChmodFiles with any type of body
+func NewChmodFilesRequestWithBody(server string, contentType string, body io.Reader) (*http.Request, error) {
+	var err error
+
+	serverURL, err := url.Parse(server)
+	if err != nil {
+		return nil, err
+	}
+
+	operationPath := fmt.Sprintf("/files/permissions")
+	if operationPath[0] == '/' {
+		operationPath = "." + operationPath
+	}
+
+	queryURL, err := serverURL.Parse(operationPath)
+	if err != nil {
+		return nil, err
+	}
+
+	req, err := http.NewRequest("POST", queryURL.String(), body)
+	if err != nil {
+		return nil, err
+	}
+
+	req.Header.Add("Content-Type", contentType)
+
+	return req, nil
+}
+
+// NewReplaceContentRequest calls the generic ReplaceContent builder with application/json body
+func NewReplaceContentRequest(server string, body ReplaceContentJSONRequestBody) (*http.Request, error) {
+	var bodyReader io.Reader
+	buf, err := json.Marshal(body)
+	if err != nil {
+		return nil, err
+	}
+	bodyReader = bytes.NewReader(buf)
+	return NewReplaceContentRequestWithBody(server, "application/json", bodyReader)
+}
+
+// NewReplaceContentRequestWithBody generates requests for ReplaceContent with any type of body
+func NewReplaceContentRequestWithBody(server string, contentType string, body io.Reader) (*http.Request, error) {
+	var err error
+
+	serverURL, err := url.Parse(server)
+	if err != nil {
+		return nil, err
+	}
+
+	operationPath := fmt.Sprintf("/files/replace")
+	if operationPath[0] == '/' {
+		operationPath = "." + operationPath
+	}
+
+	queryURL, err := serverURL.Parse(operationPath)
+	if err != nil {
+		return nil, err
+	}
+
+	req, err := http.NewRequest("POST", queryURL.String(), body)
+	if err != nil {
+		return nil, err
+	}
+
+	req.Header.Add("Content-Type", contentType)
+
+	return req, nil
+}
+
+// NewSearchFilesRequest generates requests for SearchFiles
+func NewSearchFilesRequest(server string, params *SearchFilesParams) (*http.Request, error) {
+	var err error
+
+	serverURL, err := url.Parse(server)
+	if err != nil {
+		return nil, err
+	}
+
+	operationPath := fmt.Sprintf("/files/search")
+	if operationPath[0] == '/' {
+		operationPath = "." + operationPath
+	}
+
+	queryURL, err := serverURL.Parse(operationPath)
+	if err != nil {
+		return nil, err
+	}
+
+	if params != nil {
+		queryValues := queryURL.Query()
+
+		if queryFrag, err := runtime.StyleParamWithOptions("form", true, "path", params.Path, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "string", Format: ""}); err != nil {
+			return nil, err
+		} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+			return nil, err
+		} else {
+			for k, v := range parsed {
+				for _, v2 := range v {
+					queryValues.Add(k, v2)
+				}
+			}
+		}
+
+		if params.Pattern != nil {
+
+			if queryFrag, err := runtime.StyleParamWithOptions("form", true, "pattern", *params.Pattern, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "string", Format: ""}); err != nil {
+				return nil, err
+			} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+				return nil, err
+			} else {
+				for k, v := range parsed {
+					for _, v2 := range v {
+						queryValues.Add(k, v2)
+					}
+				}
+			}
+
+		}
+
+		queryURL.RawQuery = queryValues.Encode()
+	}
+
+	req, err := http.NewRequest("GET", queryURL.String(), nil)
+	if err != nil {
+		return nil, err
+	}
+
+	return req, nil
+}
+
+// NewUploadFileRequestWithBody generates requests for UploadFile with any type of body
+func NewUploadFileRequestWithBody(server string, contentType string, body io.Reader) (*http.Request, error) {
+	var err error
+
+	serverURL, err := url.Parse(server)
+	if err != nil {
+		return nil, err
+	}
+
+	operationPath := fmt.Sprintf("/files/upload")
+	if operationPath[0] == '/' {
+		operationPath = "." + operationPath
+	}
+
+	queryURL, err := serverURL.Parse(operationPath)
+	if err != nil {
+		return nil, err
+	}
+
+	req, err := http.NewRequest("POST", queryURL.String(), body)
+	if err != nil {
+		return nil, err
+	}
+
+	req.Header.Add("Content-Type", contentType)
+
+	return req, nil
+}
+
+// NewGetMetricsRequest generates requests for GetMetrics
+func NewGetMetricsRequest(server string) (*http.Request, error) {
+	var err error
+
+	serverURL, err := url.Parse(server)
+	if err != nil {
+		return nil, err
+	}
+
+	operationPath := fmt.Sprintf("/metrics")
+	if operationPath[0] == '/' {
+		operationPath = "." + operationPath
+	}
+
+	queryURL, err := serverURL.Parse(operationPath)
+	if err != nil {
+		return nil, err
+	}
+
+	req, err := http.NewRequest("GET", queryURL.String(), nil)
+	if err != nil {
+		return nil, err
+	}
+
+	return req, nil
+}
+
+// NewWatchMetricsRequest generates requests for WatchMetrics
+func NewWatchMetricsRequest(server string) (*http.Request, error) {
+	var err error
+
+	serverURL, err := url.Parse(server)
+	if err != nil {
+		return nil, err
+	}
+
+	operationPath := fmt.Sprintf("/metrics/watch")
+	if operationPath[0] == '/' {
+		operationPath = "." + operationPath
+	}
+
+	queryURL, err := serverURL.Parse(operationPath)
+	if err != nil {
+		return nil, err
+	}
+
+	req, err := http.NewRequest("GET", queryURL.String(), nil)
+	if err != nil {
+		return nil, err
+	}
+
+	return req, nil
+}
+
+// NewPingRequest generates requests for Ping
+func NewPingRequest(server string) (*http.Request, error) {
+	var err error
+
+	serverURL, err := url.Parse(server)
+	if err != nil {
+		return nil, err
+	}
+
+	operationPath := fmt.Sprintf("/ping")
+	if operationPath[0] == '/' {
+		operationPath = "." + operationPath
+	}
+
+	queryURL, err := serverURL.Parse(operationPath)
+	if err != nil {
+		return nil, err
+	}
+
+	req, err := http.NewRequest("GET", queryURL.String(), nil)
+	if err != nil {
+		return nil, err
+	}
+
+	return req, nil
+}
+
+// NewCreateSessionRequest calls the generic CreateSession builder with application/json body
+func NewCreateSessionRequest(server string, body CreateSessionJSONRequestBody) (*http.Request, error) {
+	var bodyReader io.Reader
+	buf, err := json.Marshal(body)
+	if err != nil {
+		return nil, err
+	}
+	bodyReader = bytes.NewReader(buf)
+	return NewCreateSessionRequestWithBody(server, "application/json", bodyReader)
+}
+
+// NewCreateSessionRequestWithBody generates requests for CreateSession with any type of body
+func NewCreateSessionRequestWithBody(server string, contentType string, body io.Reader) (*http.Request, error) {
+	var err error
+
+	serverURL, err := url.Parse(server)
+	if err != nil {
+		return nil, err
+	}
+
+	operationPath := fmt.Sprintf("/session")
+	if operationPath[0] == '/' {
+		operationPath = "." + operationPath
+	}
+
+	queryURL, err := serverURL.Parse(operationPath)
+	if err != nil {
+		return nil, err
+	}
+
+	req, err := http.NewRequest("POST", queryURL.String(), body)
+	if err != nil {
+		return nil, err
+	}
+
+	req.Header.Add("Content-Type", contentType)
+
+	return req, nil
+}
+
+// NewDeleteSessionRequest generates requests for DeleteSession
+func NewDeleteSessionRequest(server string, sessionID string) (*http.Request, error) {
+	var err error
+
+	var pathParam0 string
+
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "sessionId", sessionID, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
+	if err != nil {
+		return nil, err
+	}
+
+	serverURL, err := url.Parse(server)
+	if err != nil {
+		return nil, err
+	}
+
+	operationPath := fmt.Sprintf("/session/%s", pathParam0)
+	if operationPath[0] == '/' {
+		operationPath = "." + operationPath
+	}
+
+	queryURL, err := serverURL.Parse(operationPath)
+	if err != nil {
+		return nil, err
+	}
+
+	req, err := http.NewRequest("DELETE", queryURL.String(), nil)
+	if err != nil {
+		return nil, err
+	}
+
+	return req, nil
+}
+
+// NewRunInSessionRequest calls the generic RunInSession builder with application/json body
+func NewRunInSessionRequest(server string, sessionID string, body RunInSessionJSONRequestBody) (*http.Request, error) {
+	var bodyReader io.Reader
+	buf, err := json.Marshal(body)
+	if err != nil {
+		return nil, err
+	}
+	bodyReader = bytes.NewReader(buf)
+	return NewRunInSessionRequestWithBody(server, sessionID, "application/json", bodyReader)
+}
+
+// NewRunInSessionRequestWithBody generates requests for RunInSession with any type of body
+func NewRunInSessionRequestWithBody(server string, sessionID string, contentType string, body io.Reader) (*http.Request, error) {
+	var err error
+
+	var pathParam0 string
+
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "sessionId", sessionID, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
+	if err != nil {
+		return nil, err
+	}
+
+	serverURL, err := url.Parse(server)
+	if err != nil {
+		return nil, err
+	}
+
+	operationPath := fmt.Sprintf("/session/%s/run", pathParam0)
+	if operationPath[0] == '/' {
+		operationPath = "." + operationPath
+	}
+
+	queryURL, err := serverURL.Parse(operationPath)
+	if err != nil {
+		return nil, err
+	}
+
+	req, err := http.NewRequest("POST", queryURL.String(), body)
+	if err != nil {
+		return nil, err
+	}
+
+	req.Header.Add("Content-Type", contentType)
+
+	return req, nil
+}
+
+func (c *Client) applyEditors(ctx context.Context, req *http.Request, additionalEditors []RequestEditorFn) error {
+	for _, r := range c.RequestEditors {
+		if err := r(ctx, req); err != nil {
+			return err
+		}
+	}
+	for _, r := range additionalEditors {
+		if err := r(ctx, req); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// ClientWithResponses builds on ClientInterface to offer response payloads
+type ClientWithResponses struct {
+	ClientInterface
+}
+
+// NewClientWithResponses creates a new ClientWithResponses, which wraps
+// Client with return type handling
+func NewClientWithResponses(server string, opts ...ClientOption) (*ClientWithResponses, error) {
+	client, err := NewClient(server, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return &ClientWithResponses{client}, nil
+}
+
+// WithBaseURL overrides the baseURL.
+func WithBaseURL(baseURL string) ClientOption {
+	return func(c *Client) error {
+		newBaseURL, err := url.Parse(baseURL)
+		if err != nil {
+			return err
+		}
+		c.Server = newBaseURL.String()
+		return nil
+	}
+}
+
+// ClientWithResponsesInterface is the interface specification for the client with responses above.
+type ClientWithResponsesInterface interface {
+	// InterruptCodeWithResponse request
+	InterruptCodeWithResponse(ctx context.Context, params *InterruptCodeParams, reqEditors ...RequestEditorFn) (*InterruptCodeResponse, error)
+
+	// RunCodeWithBodyWithResponse request with any body
+	RunCodeWithBodyWithResponse(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*RunCodeResponse, error)
+
+	RunCodeWithResponse(ctx context.Context, body RunCodeJSONRequestBody, reqEditors ...RequestEditorFn) (*RunCodeResponse, error)
+
+	// CreateCodeContextWithBodyWithResponse request with any body
+	CreateCodeContextWithBodyWithResponse(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*CreateCodeContextResponse, error)
+
+	CreateCodeContextWithResponse(ctx context.Context, body CreateCodeContextJSONRequestBody, reqEditors ...RequestEditorFn) (*CreateCodeContextResponse, error)
+
+	// DeleteContextsByLanguageWithResponse request
+	DeleteContextsByLanguageWithResponse(ctx context.Context, params *DeleteContextsByLanguageParams, reqEditors ...RequestEditorFn) (*DeleteContextsByLanguageResponse, error)
+
+	// ListContextsWithResponse request
+	ListContextsWithResponse(ctx context.Context, params *ListContextsParams, reqEditors ...RequestEditorFn) (*ListContextsResponse, error)
+
+	// DeleteContextWithResponse request
+	DeleteContextWithResponse(ctx context.Context, contextID string, reqEditors ...RequestEditorFn) (*DeleteContextResponse, error)
+
+	// GetContextWithResponse request
+	GetContextWithResponse(ctx context.Context, contextID string, reqEditors ...RequestEditorFn) (*GetContextResponse, error)
+
+	// InterruptCommandWithResponse request
+	InterruptCommandWithResponse(ctx context.Context, params *InterruptCommandParams, reqEditors ...RequestEditorFn) (*InterruptCommandResponse, error)
+
+	// RunCommandWithBodyWithResponse request with any body
+	RunCommandWithBodyWithResponse(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*RunCommandResponse, error)
+
+	RunCommandWithResponse(ctx context.Context, body RunCommandJSONRequestBody, reqEditors ...RequestEditorFn) (*RunCommandResponse, error)
+
+	// GetCommandStatusWithResponse request
+	GetCommandStatusWithResponse(ctx context.Context, id string, reqEditors ...RequestEditorFn) (*GetCommandStatusResponse, error)
+
+	// GetBackgroundCommandLogsWithResponse request
+	GetBackgroundCommandLogsWithResponse(ctx context.Context, id string, params *GetBackgroundCommandLogsParams, reqEditors ...RequestEditorFn) (*GetBackgroundCommandLogsResponse, error)
+
+	// RemoveDirsWithResponse request
+	RemoveDirsWithResponse(ctx context.Context, params *RemoveDirsParams, reqEditors ...RequestEditorFn) (*RemoveDirsResponse, error)
+
+	// MakeDirsWithBodyWithResponse request with any body
+	MakeDirsWithBodyWithResponse(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*MakeDirsResponse, error)
+
+	MakeDirsWithResponse(ctx context.Context, body MakeDirsJSONRequestBody, reqEditors ...RequestEditorFn) (*MakeDirsResponse, error)
+
+	// RemoveFilesWithResponse request
+	RemoveFilesWithResponse(ctx context.Context, params *RemoveFilesParams, reqEditors ...RequestEditorFn) (*RemoveFilesResponse, error)
+
+	// DownloadFileWithResponse request
+	DownloadFileWithResponse(ctx context.Context, params *DownloadFileParams, reqEditors ...RequestEditorFn) (*DownloadFileResponse, error)
+
+	// GetFilesInfoWithResponse request
+	GetFilesInfoWithResponse(ctx context.Context, params *GetFilesInfoParams, reqEditors ...RequestEditorFn) (*GetFilesInfoResponse, error)
+
+	// RenameFilesWithBodyWithResponse request with any body
+	RenameFilesWithBodyWithResponse(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*RenameFilesResponse, error)
+
+	RenameFilesWithResponse(ctx context.Context, body RenameFilesJSONRequestBody, reqEditors ...RequestEditorFn) (*RenameFilesResponse, error)
+
+	// ChmodFilesWithBodyWithResponse request with any body
+	ChmodFilesWithBodyWithResponse(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*ChmodFilesResponse, error)
+
+	ChmodFilesWithResponse(ctx context.Context, body ChmodFilesJSONRequestBody, reqEditors ...RequestEditorFn) (*ChmodFilesResponse, error)
+
+	// ReplaceContentWithBodyWithResponse request with any body
+	ReplaceContentWithBodyWithResponse(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*ReplaceContentResponse, error)
+
+	ReplaceContentWithResponse(ctx context.Context, body ReplaceContentJSONRequestBody, reqEditors ...RequestEditorFn) (*ReplaceContentResponse, error)
+
+	// SearchFilesWithResponse request
+	SearchFilesWithResponse(ctx context.Context, params *SearchFilesParams, reqEditors ...RequestEditorFn) (*SearchFilesResponse, error)
+
+	// UploadFileWithBodyWithResponse request with any body
+	UploadFileWithBodyWithResponse(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*UploadFileResponse, error)
+
+	// GetMetricsWithResponse request
+	GetMetricsWithResponse(ctx context.Context, reqEditors ...RequestEditorFn) (*GetMetricsResponse, error)
+
+	// WatchMetricsWithResponse request
+	WatchMetricsWithResponse(ctx context.Context, reqEditors ...RequestEditorFn) (*WatchMetricsResponse, error)
+
+	// PingWithResponse request
+	PingWithResponse(ctx context.Context, reqEditors ...RequestEditorFn) (*PingResponse, error)
+
+	// CreateSessionWithBodyWithResponse request with any body
+	CreateSessionWithBodyWithResponse(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*CreateSessionResponse, error)
+
+	CreateSessionWithResponse(ctx context.Context, body CreateSessionJSONRequestBody, reqEditors ...RequestEditorFn) (*CreateSessionResponse, error)
+
+	// DeleteSessionWithResponse request
+	DeleteSessionWithResponse(ctx context.Context, sessionID string, reqEditors ...RequestEditorFn) (*DeleteSessionResponse, error)
+
+	// RunInSessionWithBodyWithResponse request with any body
+	RunInSessionWithBodyWithResponse(ctx context.Context, sessionID string, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*RunInSessionResponse, error)
+
+	RunInSessionWithResponse(ctx context.Context, sessionID string, body RunInSessionJSONRequestBody, reqEditors ...RequestEditorFn) (*RunInSessionResponse, error)
+}
+
+type InterruptCodeResponse struct {
+	Body         []byte
+	HTTPResponse *http.Response
+	JSON400      *BadRequest
+	JSON500      *InternalServerError
+}
+
+// Status returns HTTPResponse.Status
+func (r InterruptCodeResponse) Status() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Status
+	}
+	return http.StatusText(0)
+}
+
+// StatusCode returns HTTPResponse.StatusCode
+func (r InterruptCodeResponse) StatusCode() int {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.StatusCode
+	}
+	return 0
+}
+
+type RunCodeResponse struct {
+	Body         []byte
+	HTTPResponse *http.Response
+	JSON400      *BadRequest
+	JSON500      *InternalServerError
+}
+
+// Status returns HTTPResponse.Status
+func (r RunCodeResponse) Status() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Status
+	}
+	return http.StatusText(0)
+}
+
+// StatusCode returns HTTPResponse.StatusCode
+func (r RunCodeResponse) StatusCode() int {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.StatusCode
+	}
+	return 0
+}
+
+type CreateCodeContextResponse struct {
+	Body         []byte
+	HTTPResponse *http.Response
+	JSON200      *CodeContext
+	JSON400      *BadRequest
+	JSON500      *InternalServerError
+}
+
+// Status returns HTTPResponse.Status
+func (r CreateCodeContextResponse) Status() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Status
+	}
+	return http.StatusText(0)
+}
+
+// StatusCode returns HTTPResponse.StatusCode
+func (r CreateCodeContextResponse) StatusCode() int {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.StatusCode
+	}
+	return 0
+}
+
+type DeleteContextsByLanguageResponse struct {
+	Body         []byte
+	HTTPResponse *http.Response
+	JSON400      *BadRequest
+	JSON500      *InternalServerError
+}
+
+// Status returns HTTPResponse.Status
+func (r DeleteContextsByLanguageResponse) Status() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Status
+	}
+	return http.StatusText(0)
+}
+
+// StatusCode returns HTTPResponse.StatusCode
+func (r DeleteContextsByLanguageResponse) StatusCode() int {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.StatusCode
+	}
+	return 0
+}
+
+type ListContextsResponse struct {
+	Body         []byte
+	HTTPResponse *http.Response
+	JSON200      *[]CodeContext
+	JSON400      *BadRequest
+	JSON500      *InternalServerError
+}
+
+// Status returns HTTPResponse.Status
+func (r ListContextsResponse) Status() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Status
+	}
+	return http.StatusText(0)
+}
+
+// StatusCode returns HTTPResponse.StatusCode
+func (r ListContextsResponse) StatusCode() int {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.StatusCode
+	}
+	return 0
+}
+
+type DeleteContextResponse struct {
+	Body         []byte
+	HTTPResponse *http.Response
+	JSON400      *BadRequest
+	JSON404      *NotFound
+	JSON500      *InternalServerError
+}
+
+// Status returns HTTPResponse.Status
+func (r DeleteContextResponse) Status() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Status
+	}
+	return http.StatusText(0)
+}
+
+// StatusCode returns HTTPResponse.StatusCode
+func (r DeleteContextResponse) StatusCode() int {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.StatusCode
+	}
+	return 0
+}
+
+type GetContextResponse struct {
+	Body         []byte
+	HTTPResponse *http.Response
+	JSON200      *CodeContext
+	JSON404      *NotFound
+	JSON500      *InternalServerError
+}
+
+// Status returns HTTPResponse.Status
+func (r GetContextResponse) Status() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Status
+	}
+	return http.StatusText(0)
+}
+
+// StatusCode returns HTTPResponse.StatusCode
+func (r GetContextResponse) StatusCode() int {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.StatusCode
+	}
+	return 0
+}
+
+type InterruptCommandResponse struct {
+	Body         []byte
+	HTTPResponse *http.Response
+	JSON400      *BadRequest
+	JSON500      *InternalServerError
+}
+
+// Status returns HTTPResponse.Status
+func (r InterruptCommandResponse) Status() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Status
+	}
+	return http.StatusText(0)
+}
+
+// StatusCode returns HTTPResponse.StatusCode
+func (r InterruptCommandResponse) StatusCode() int {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.StatusCode
+	}
+	return 0
+}
+
+type RunCommandResponse struct {
+	Body         []byte
+	HTTPResponse *http.Response
+	JSON400      *BadRequest
+	JSON500      *InternalServerError
+}
+
+// Status returns HTTPResponse.Status
+func (r RunCommandResponse) Status() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Status
+	}
+	return http.StatusText(0)
+}
+
+// StatusCode returns HTTPResponse.StatusCode
+func (r RunCommandResponse) StatusCode() int {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.StatusCode
+	}
+	return 0
+}
+
+type GetCommandStatusResponse struct {
+	Body         []byte
+	HTTPResponse *http.Response
+	JSON200      *CommandStatusResponse
+	JSON400      *BadRequest
+	JSON404      *NotFound
+	JSON500      *InternalServerError
+}
+
+// Status returns HTTPResponse.Status
+func (r GetCommandStatusResponse) Status() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Status
+	}
+	return http.StatusText(0)
+}
+
+// StatusCode returns HTTPResponse.StatusCode
+func (r GetCommandStatusResponse) StatusCode() int {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.StatusCode
+	}
+	return 0
+}
+
+type GetBackgroundCommandLogsResponse struct {
+	Body         []byte
+	HTTPResponse *http.Response
+	JSON400      *BadRequest
+	JSON404      *NotFound
+	JSON500      *InternalServerError
+}
+
+// Status returns HTTPResponse.Status
+func (r GetBackgroundCommandLogsResponse) Status() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Status
+	}
+	return http.StatusText(0)
+}
+
+// StatusCode returns HTTPResponse.StatusCode
+func (r GetBackgroundCommandLogsResponse) StatusCode() int {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.StatusCode
+	}
+	return 0
+}
+
+type RemoveDirsResponse struct {
+	Body         []byte
+	HTTPResponse *http.Response
+	JSON500      *InternalServerError
+}
+
+// Status returns HTTPResponse.Status
+func (r RemoveDirsResponse) Status() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Status
+	}
+	return http.StatusText(0)
+}
+
+// StatusCode returns HTTPResponse.StatusCode
+func (r RemoveDirsResponse) StatusCode() int {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.StatusCode
+	}
+	return 0
+}
+
+type MakeDirsResponse struct {
+	Body         []byte
+	HTTPResponse *http.Response
+	JSON400      *BadRequest
+	JSON500      *InternalServerError
+}
+
+// Status returns HTTPResponse.Status
+func (r MakeDirsResponse) Status() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Status
+	}
+	return http.StatusText(0)
+}
+
+// StatusCode returns HTTPResponse.StatusCode
+func (r MakeDirsResponse) StatusCode() int {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.StatusCode
+	}
+	return 0
+}
+
+type RemoveFilesResponse struct {
+	Body         []byte
+	HTTPResponse *http.Response
+	JSON500      *InternalServerError
+}
+
+// Status returns HTTPResponse.Status
+func (r RemoveFilesResponse) Status() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Status
+	}
+	return http.StatusText(0)
+}
+
+// StatusCode returns HTTPResponse.StatusCode
+func (r RemoveFilesResponse) StatusCode() int {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.StatusCode
+	}
+	return 0
+}
+
+type DownloadFileResponse struct {
+	Body         []byte
+	HTTPResponse *http.Response
+	JSON400      *BadRequest
+	JSON404      *NotFound
+	JSON416      *ErrorResponse
+	JSON500      *InternalServerError
+}
+
+// Status returns HTTPResponse.Status
+func (r DownloadFileResponse) Status() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Status
+	}
+	return http.StatusText(0)
+}
+
+// StatusCode returns HTTPResponse.StatusCode
+func (r DownloadFileResponse) StatusCode() int {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.StatusCode
+	}
+	return 0
+}
+
+type GetFilesInfoResponse struct {
+	Body         []byte
+	HTTPResponse *http.Response
+	JSON200      *map[string]FileInfo
+	JSON404      *NotFound
+	JSON500      *InternalServerError
+}
+
+// Status returns HTTPResponse.Status
+func (r GetFilesInfoResponse) Status() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Status
+	}
+	return http.StatusText(0)
+}
+
+// StatusCode returns HTTPResponse.StatusCode
+func (r GetFilesInfoResponse) StatusCode() int {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.StatusCode
+	}
+	return 0
+}
+
+type RenameFilesResponse struct {
+	Body         []byte
+	HTTPResponse *http.Response
+	JSON400      *BadRequest
+	JSON404      *NotFound
+	JSON500      *InternalServerError
+}
+
+// Status returns HTTPResponse.Status
+func (r RenameFilesResponse) Status() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Status
+	}
+	return http.StatusText(0)
+}
+
+// StatusCode returns HTTPResponse.StatusCode
+func (r RenameFilesResponse) StatusCode() int {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.StatusCode
+	}
+	return 0
+}
+
+type ChmodFilesResponse struct {
+	Body         []byte
+	HTTPResponse *http.Response
+	JSON400      *BadRequest
+	JSON500      *InternalServerError
+}
+
+// Status returns HTTPResponse.Status
+func (r ChmodFilesResponse) Status() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Status
+	}
+	return http.StatusText(0)
+}
+
+// StatusCode returns HTTPResponse.StatusCode
+func (r ChmodFilesResponse) StatusCode() int {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.StatusCode
+	}
+	return 0
+}
+
+type ReplaceContentResponse struct {
+	Body         []byte
+	HTTPResponse *http.Response
+	JSON400      *BadRequest
+	JSON500      *InternalServerError
+}
+
+// Status returns HTTPResponse.Status
+func (r ReplaceContentResponse) Status() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Status
+	}
+	return http.StatusText(0)
+}
+
+// StatusCode returns HTTPResponse.StatusCode
+func (r ReplaceContentResponse) StatusCode() int {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.StatusCode
+	}
+	return 0
+}
+
+type SearchFilesResponse struct {
+	Body         []byte
+	HTTPResponse *http.Response
+	JSON200      *[]FileInfo
+	JSON400      *BadRequest
+	JSON404      *NotFound
+	JSON500      *InternalServerError
+}
+
+// Status returns HTTPResponse.Status
+func (r SearchFilesResponse) Status() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Status
+	}
+	return http.StatusText(0)
+}
+
+// StatusCode returns HTTPResponse.StatusCode
+func (r SearchFilesResponse) StatusCode() int {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.StatusCode
+	}
+	return 0
+}
+
+type UploadFileResponse struct {
+	Body         []byte
+	HTTPResponse *http.Response
+	JSON400      *BadRequest
+	JSON500      *InternalServerError
+}
+
+// Status returns HTTPResponse.Status
+func (r UploadFileResponse) Status() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Status
+	}
+	return http.StatusText(0)
+}
+
+// StatusCode returns HTTPResponse.StatusCode
+func (r UploadFileResponse) StatusCode() int {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.StatusCode
+	}
+	return 0
+}
+
+type GetMetricsResponse struct {
+	Body         []byte
+	HTTPResponse *http.Response
+	JSON200      *Metrics
+	JSON500      *InternalServerError
+}
+
+// Status returns HTTPResponse.Status
+func (r GetMetricsResponse) Status() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Status
+	}
+	return http.StatusText(0)
+}
+
+// StatusCode returns HTTPResponse.StatusCode
+func (r GetMetricsResponse) StatusCode() int {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.StatusCode
+	}
+	return 0
+}
+
+type WatchMetricsResponse struct {
+	Body         []byte
+	HTTPResponse *http.Response
+	JSON500      *InternalServerError
+}
+
+// Status returns HTTPResponse.Status
+func (r WatchMetricsResponse) Status() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Status
+	}
+	return http.StatusText(0)
+}
+
+// StatusCode returns HTTPResponse.StatusCode
+func (r WatchMetricsResponse) StatusCode() int {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.StatusCode
+	}
+	return 0
+}
+
+type PingResponse struct {
+	Body         []byte
+	HTTPResponse *http.Response
+}
+
+// Status returns HTTPResponse.Status
+func (r PingResponse) Status() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Status
+	}
+	return http.StatusText(0)
+}
+
+// StatusCode returns HTTPResponse.StatusCode
+func (r PingResponse) StatusCode() int {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.StatusCode
+	}
+	return 0
+}
+
+type CreateSessionResponse struct {
+	Body         []byte
+	HTTPResponse *http.Response
+	JSON200      *SessionCreated
+	JSON400      *BadRequest
+	JSON500      *InternalServerError
+}
+
+// Status returns HTTPResponse.Status
+func (r CreateSessionResponse) Status() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Status
+	}
+	return http.StatusText(0)
+}
+
+// StatusCode returns HTTPResponse.StatusCode
+func (r CreateSessionResponse) StatusCode() int {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.StatusCode
+	}
+	return 0
+}
+
+type DeleteSessionResponse struct {
+	Body         []byte
+	HTTPResponse *http.Response
+	JSON400      *BadRequest
+	JSON404      *NotFound
+	JSON500      *InternalServerError
+}
+
+// Status returns HTTPResponse.Status
+func (r DeleteSessionResponse) Status() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Status
+	}
+	return http.StatusText(0)
+}
+
+// StatusCode returns HTTPResponse.StatusCode
+func (r DeleteSessionResponse) StatusCode() int {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.StatusCode
+	}
+	return 0
+}
+
+type RunInSessionResponse struct {
+	Body         []byte
+	HTTPResponse *http.Response
+	JSON400      *BadRequest
+	JSON500      *InternalServerError
+}
+
+// Status returns HTTPResponse.Status
+func (r RunInSessionResponse) Status() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Status
+	}
+	return http.StatusText(0)
+}
+
+// StatusCode returns HTTPResponse.StatusCode
+func (r RunInSessionResponse) StatusCode() int {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.StatusCode
+	}
+	return 0
+}
+
+// InterruptCodeWithResponse request returning *InterruptCodeResponse
+func (c *ClientWithResponses) InterruptCodeWithResponse(ctx context.Context, params *InterruptCodeParams, reqEditors ...RequestEditorFn) (*InterruptCodeResponse, error) {
+	rsp, err := c.InterruptCode(ctx, params, reqEditors...)
+	if err != nil {
+		return nil, err
+	}
+	return ParseInterruptCodeResponse(rsp)
+}
+
+// RunCodeWithBodyWithResponse request with arbitrary body returning *RunCodeResponse
+func (c *ClientWithResponses) RunCodeWithBodyWithResponse(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*RunCodeResponse, error) {
+	rsp, err := c.RunCodeWithBody(ctx, contentType, body, reqEditors...)
+	if err != nil {
+		return nil, err
+	}
+	return ParseRunCodeResponse(rsp)
+}
+
+func (c *ClientWithResponses) RunCodeWithResponse(ctx context.Context, body RunCodeJSONRequestBody, reqEditors ...RequestEditorFn) (*RunCodeResponse, error) {
+	rsp, err := c.RunCode(ctx, body, reqEditors...)
+	if err != nil {
+		return nil, err
+	}
+	return ParseRunCodeResponse(rsp)
+}
+
+// CreateCodeContextWithBodyWithResponse request with arbitrary body returning *CreateCodeContextResponse
+func (c *ClientWithResponses) CreateCodeContextWithBodyWithResponse(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*CreateCodeContextResponse, error) {
+	rsp, err := c.CreateCodeContextWithBody(ctx, contentType, body, reqEditors...)
+	if err != nil {
+		return nil, err
+	}
+	return ParseCreateCodeContextResponse(rsp)
+}
+
+func (c *ClientWithResponses) CreateCodeContextWithResponse(ctx context.Context, body CreateCodeContextJSONRequestBody, reqEditors ...RequestEditorFn) (*CreateCodeContextResponse, error) {
+	rsp, err := c.CreateCodeContext(ctx, body, reqEditors...)
+	if err != nil {
+		return nil, err
+	}
+	return ParseCreateCodeContextResponse(rsp)
+}
+
+// DeleteContextsByLanguageWithResponse request returning *DeleteContextsByLanguageResponse
+func (c *ClientWithResponses) DeleteContextsByLanguageWithResponse(ctx context.Context, params *DeleteContextsByLanguageParams, reqEditors ...RequestEditorFn) (*DeleteContextsByLanguageResponse, error) {
+	rsp, err := c.DeleteContextsByLanguage(ctx, params, reqEditors...)
+	if err != nil {
+		return nil, err
+	}
+	return ParseDeleteContextsByLanguageResponse(rsp)
+}
+
+// ListContextsWithResponse request returning *ListContextsResponse
+func (c *ClientWithResponses) ListContextsWithResponse(ctx context.Context, params *ListContextsParams, reqEditors ...RequestEditorFn) (*ListContextsResponse, error) {
+	rsp, err := c.ListContexts(ctx, params, reqEditors...)
+	if err != nil {
+		return nil, err
+	}
+	return ParseListContextsResponse(rsp)
+}
+
+// DeleteContextWithResponse request returning *DeleteContextResponse
+func (c *ClientWithResponses) DeleteContextWithResponse(ctx context.Context, contextID string, reqEditors ...RequestEditorFn) (*DeleteContextResponse, error) {
+	rsp, err := c.DeleteContext(ctx, contextID, reqEditors...)
+	if err != nil {
+		return nil, err
+	}
+	return ParseDeleteContextResponse(rsp)
+}
+
+// GetContextWithResponse request returning *GetContextResponse
+func (c *ClientWithResponses) GetContextWithResponse(ctx context.Context, contextID string, reqEditors ...RequestEditorFn) (*GetContextResponse, error) {
+	rsp, err := c.GetContext(ctx, contextID, reqEditors...)
+	if err != nil {
+		return nil, err
+	}
+	return ParseGetContextResponse(rsp)
+}
+
+// InterruptCommandWithResponse request returning *InterruptCommandResponse
+func (c *ClientWithResponses) InterruptCommandWithResponse(ctx context.Context, params *InterruptCommandParams, reqEditors ...RequestEditorFn) (*InterruptCommandResponse, error) {
+	rsp, err := c.InterruptCommand(ctx, params, reqEditors...)
+	if err != nil {
+		return nil, err
+	}
+	return ParseInterruptCommandResponse(rsp)
+}
+
+// RunCommandWithBodyWithResponse request with arbitrary body returning *RunCommandResponse
+func (c *ClientWithResponses) RunCommandWithBodyWithResponse(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*RunCommandResponse, error) {
+	rsp, err := c.RunCommandWithBody(ctx, contentType, body, reqEditors...)
+	if err != nil {
+		return nil, err
+	}
+	return ParseRunCommandResponse(rsp)
+}
+
+func (c *ClientWithResponses) RunCommandWithResponse(ctx context.Context, body RunCommandJSONRequestBody, reqEditors ...RequestEditorFn) (*RunCommandResponse, error) {
+	rsp, err := c.RunCommand(ctx, body, reqEditors...)
+	if err != nil {
+		return nil, err
+	}
+	return ParseRunCommandResponse(rsp)
+}
+
+// GetCommandStatusWithResponse request returning *GetCommandStatusResponse
+func (c *ClientWithResponses) GetCommandStatusWithResponse(ctx context.Context, id string, reqEditors ...RequestEditorFn) (*GetCommandStatusResponse, error) {
+	rsp, err := c.GetCommandStatus(ctx, id, reqEditors...)
+	if err != nil {
+		return nil, err
+	}
+	return ParseGetCommandStatusResponse(rsp)
+}
+
+// GetBackgroundCommandLogsWithResponse request returning *GetBackgroundCommandLogsResponse
+func (c *ClientWithResponses) GetBackgroundCommandLogsWithResponse(ctx context.Context, id string, params *GetBackgroundCommandLogsParams, reqEditors ...RequestEditorFn) (*GetBackgroundCommandLogsResponse, error) {
+	rsp, err := c.GetBackgroundCommandLogs(ctx, id, params, reqEditors...)
+	if err != nil {
+		return nil, err
+	}
+	return ParseGetBackgroundCommandLogsResponse(rsp)
+}
+
+// RemoveDirsWithResponse request returning *RemoveDirsResponse
+func (c *ClientWithResponses) RemoveDirsWithResponse(ctx context.Context, params *RemoveDirsParams, reqEditors ...RequestEditorFn) (*RemoveDirsResponse, error) {
+	rsp, err := c.RemoveDirs(ctx, params, reqEditors...)
+	if err != nil {
+		return nil, err
+	}
+	return ParseRemoveDirsResponse(rsp)
+}
+
+// MakeDirsWithBodyWithResponse request with arbitrary body returning *MakeDirsResponse
+func (c *ClientWithResponses) MakeDirsWithBodyWithResponse(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*MakeDirsResponse, error) {
+	rsp, err := c.MakeDirsWithBody(ctx, contentType, body, reqEditors...)
+	if err != nil {
+		return nil, err
+	}
+	return ParseMakeDirsResponse(rsp)
+}
+
+func (c *ClientWithResponses) MakeDirsWithResponse(ctx context.Context, body MakeDirsJSONRequestBody, reqEditors ...RequestEditorFn) (*MakeDirsResponse, error) {
+	rsp, err := c.MakeDirs(ctx, body, reqEditors...)
+	if err != nil {
+		return nil, err
+	}
+	return ParseMakeDirsResponse(rsp)
+}
+
+// RemoveFilesWithResponse request returning *RemoveFilesResponse
+func (c *ClientWithResponses) RemoveFilesWithResponse(ctx context.Context, params *RemoveFilesParams, reqEditors ...RequestEditorFn) (*RemoveFilesResponse, error) {
+	rsp, err := c.RemoveFiles(ctx, params, reqEditors...)
+	if err != nil {
+		return nil, err
+	}
+	return ParseRemoveFilesResponse(rsp)
+}
+
+// DownloadFileWithResponse request returning *DownloadFileResponse
+func (c *ClientWithResponses) DownloadFileWithResponse(ctx context.Context, params *DownloadFileParams, reqEditors ...RequestEditorFn) (*DownloadFileResponse, error) {
+	rsp, err := c.DownloadFile(ctx, params, reqEditors...)
+	if err != nil {
+		return nil, err
+	}
+	return ParseDownloadFileResponse(rsp)
+}
+
+// GetFilesInfoWithResponse request returning *GetFilesInfoResponse
+func (c *ClientWithResponses) GetFilesInfoWithResponse(ctx context.Context, params *GetFilesInfoParams, reqEditors ...RequestEditorFn) (*GetFilesInfoResponse, error) {
+	rsp, err := c.GetFilesInfo(ctx, params, reqEditors...)
+	if err != nil {
+		return nil, err
+	}
+	return ParseGetFilesInfoResponse(rsp)
+}
+
+// RenameFilesWithBodyWithResponse request with arbitrary body returning *RenameFilesResponse
+func (c *ClientWithResponses) RenameFilesWithBodyWithResponse(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*RenameFilesResponse, error) {
+	rsp, err := c.RenameFilesWithBody(ctx, contentType, body, reqEditors...)
+	if err != nil {
+		return nil, err
+	}
+	return ParseRenameFilesResponse(rsp)
+}
+
+func (c *ClientWithResponses) RenameFilesWithResponse(ctx context.Context, body RenameFilesJSONRequestBody, reqEditors ...RequestEditorFn) (*RenameFilesResponse, error) {
+	rsp, err := c.RenameFiles(ctx, body, reqEditors...)
+	if err != nil {
+		return nil, err
+	}
+	return ParseRenameFilesResponse(rsp)
+}
+
+// ChmodFilesWithBodyWithResponse request with arbitrary body returning *ChmodFilesResponse
+func (c *ClientWithResponses) ChmodFilesWithBodyWithResponse(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*ChmodFilesResponse, error) {
+	rsp, err := c.ChmodFilesWithBody(ctx, contentType, body, reqEditors...)
+	if err != nil {
+		return nil, err
+	}
+	return ParseChmodFilesResponse(rsp)
+}
+
+func (c *ClientWithResponses) ChmodFilesWithResponse(ctx context.Context, body ChmodFilesJSONRequestBody, reqEditors ...RequestEditorFn) (*ChmodFilesResponse, error) {
+	rsp, err := c.ChmodFiles(ctx, body, reqEditors...)
+	if err != nil {
+		return nil, err
+	}
+	return ParseChmodFilesResponse(rsp)
+}
+
+// ReplaceContentWithBodyWithResponse request with arbitrary body returning *ReplaceContentResponse
+func (c *ClientWithResponses) ReplaceContentWithBodyWithResponse(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*ReplaceContentResponse, error) {
+	rsp, err := c.ReplaceContentWithBody(ctx, contentType, body, reqEditors...)
+	if err != nil {
+		return nil, err
+	}
+	return ParseReplaceContentResponse(rsp)
+}
+
+func (c *ClientWithResponses) ReplaceContentWithResponse(ctx context.Context, body ReplaceContentJSONRequestBody, reqEditors ...RequestEditorFn) (*ReplaceContentResponse, error) {
+	rsp, err := c.ReplaceContent(ctx, body, reqEditors...)
+	if err != nil {
+		return nil, err
+	}
+	return ParseReplaceContentResponse(rsp)
+}
+
+// SearchFilesWithResponse request returning *SearchFilesResponse
+func (c *ClientWithResponses) SearchFilesWithResponse(ctx context.Context, params *SearchFilesParams, reqEditors ...RequestEditorFn) (*SearchFilesResponse, error) {
+	rsp, err := c.SearchFiles(ctx, params, reqEditors...)
+	if err != nil {
+		return nil, err
+	}
+	return ParseSearchFilesResponse(rsp)
+}
+
+// UploadFileWithBodyWithResponse request with arbitrary body returning *UploadFileResponse
+func (c *ClientWithResponses) UploadFileWithBodyWithResponse(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*UploadFileResponse, error) {
+	rsp, err := c.UploadFileWithBody(ctx, contentType, body, reqEditors...)
+	if err != nil {
+		return nil, err
+	}
+	return ParseUploadFileResponse(rsp)
+}
+
+// GetMetricsWithResponse request returning *GetMetricsResponse
+func (c *ClientWithResponses) GetMetricsWithResponse(ctx context.Context, reqEditors ...RequestEditorFn) (*GetMetricsResponse, error) {
+	rsp, err := c.GetMetrics(ctx, reqEditors...)
+	if err != nil {
+		return nil, err
+	}
+	return ParseGetMetricsResponse(rsp)
+}
+
+// WatchMetricsWithResponse request returning *WatchMetricsResponse
+func (c *ClientWithResponses) WatchMetricsWithResponse(ctx context.Context, reqEditors ...RequestEditorFn) (*WatchMetricsResponse, error) {
+	rsp, err := c.WatchMetrics(ctx, reqEditors...)
+	if err != nil {
+		return nil, err
+	}
+	return ParseWatchMetricsResponse(rsp)
+}
+
+// PingWithResponse request returning *PingResponse
+func (c *ClientWithResponses) PingWithResponse(ctx context.Context, reqEditors ...RequestEditorFn) (*PingResponse, error) {
+	rsp, err := c.Ping(ctx, reqEditors...)
+	if err != nil {
+		return nil, err
+	}
+	return ParsePingResponse(rsp)
+}
+
+// CreateSessionWithBodyWithResponse request with arbitrary body returning *CreateSessionResponse
+func (c *ClientWithResponses) CreateSessionWithBodyWithResponse(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*CreateSessionResponse, error) {
+	rsp, err := c.CreateSessionWithBody(ctx, contentType, body, reqEditors...)
+	if err != nil {
+		return nil, err
+	}
+	return ParseCreateSessionResponse(rsp)
+}
+
+func (c *ClientWithResponses) CreateSessionWithResponse(ctx context.Context, body CreateSessionJSONRequestBody, reqEditors ...RequestEditorFn) (*CreateSessionResponse, error) {
+	rsp, err := c.CreateSession(ctx, body, reqEditors...)
+	if err != nil {
+		return nil, err
+	}
+	return ParseCreateSessionResponse(rsp)
+}
+
+// DeleteSessionWithResponse request returning *DeleteSessionResponse
+func (c *ClientWithResponses) DeleteSessionWithResponse(ctx context.Context, sessionID string, reqEditors ...RequestEditorFn) (*DeleteSessionResponse, error) {
+	rsp, err := c.DeleteSession(ctx, sessionID, reqEditors...)
+	if err != nil {
+		return nil, err
+	}
+	return ParseDeleteSessionResponse(rsp)
+}
+
+// RunInSessionWithBodyWithResponse request with arbitrary body returning *RunInSessionResponse
+func (c *ClientWithResponses) RunInSessionWithBodyWithResponse(ctx context.Context, sessionID string, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*RunInSessionResponse, error) {
+	rsp, err := c.RunInSessionWithBody(ctx, sessionID, contentType, body, reqEditors...)
+	if err != nil {
+		return nil, err
+	}
+	return ParseRunInSessionResponse(rsp)
+}
+
+func (c *ClientWithResponses) RunInSessionWithResponse(ctx context.Context, sessionID string, body RunInSessionJSONRequestBody, reqEditors ...RequestEditorFn) (*RunInSessionResponse, error) {
+	rsp, err := c.RunInSession(ctx, sessionID, body, reqEditors...)
+	if err != nil {
+		return nil, err
+	}
+	return ParseRunInSessionResponse(rsp)
+}
+
+// ParseInterruptCodeResponse parses an HTTP response from a InterruptCodeWithResponse call
+func ParseInterruptCodeResponse(rsp *http.Response) (*InterruptCodeResponse, error) {
+	bodyBytes, err := io.ReadAll(rsp.Body)
+	defer func() { _ = rsp.Body.Close() }()
+	if err != nil {
+		return nil, err
+	}
+
+	response := &InterruptCodeResponse{
+		Body:         bodyBytes,
+		HTTPResponse: rsp,
+	}
+
+	switch {
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 400:
+		var dest BadRequest
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON400 = &dest
+
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 500:
+		var dest InternalServerError
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON500 = &dest
+
+	}
+
+	return response, nil
+}
+
+// ParseRunCodeResponse parses an HTTP response from a RunCodeWithResponse call
+func ParseRunCodeResponse(rsp *http.Response) (*RunCodeResponse, error) {
+	bodyBytes, err := io.ReadAll(rsp.Body)
+	defer func() { _ = rsp.Body.Close() }()
+	if err != nil {
+		return nil, err
+	}
+
+	response := &RunCodeResponse{
+		Body:         bodyBytes,
+		HTTPResponse: rsp,
+	}
+
+	switch {
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 400:
+		var dest BadRequest
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON400 = &dest
+
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 500:
+		var dest InternalServerError
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON500 = &dest
+
+	}
+
+	return response, nil
+}
+
+// ParseCreateCodeContextResponse parses an HTTP response from a CreateCodeContextWithResponse call
+func ParseCreateCodeContextResponse(rsp *http.Response) (*CreateCodeContextResponse, error) {
+	bodyBytes, err := io.ReadAll(rsp.Body)
+	defer func() { _ = rsp.Body.Close() }()
+	if err != nil {
+		return nil, err
+	}
+
+	response := &CreateCodeContextResponse{
+		Body:         bodyBytes,
+		HTTPResponse: rsp,
+	}
+
+	switch {
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 200:
+		var dest CodeContext
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON200 = &dest
+
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 400:
+		var dest BadRequest
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON400 = &dest
+
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 500:
+		var dest InternalServerError
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON500 = &dest
+
+	}
+
+	return response, nil
+}
+
+// ParseDeleteContextsByLanguageResponse parses an HTTP response from a DeleteContextsByLanguageWithResponse call
+func ParseDeleteContextsByLanguageResponse(rsp *http.Response) (*DeleteContextsByLanguageResponse, error) {
+	bodyBytes, err := io.ReadAll(rsp.Body)
+	defer func() { _ = rsp.Body.Close() }()
+	if err != nil {
+		return nil, err
+	}
+
+	response := &DeleteContextsByLanguageResponse{
+		Body:         bodyBytes,
+		HTTPResponse: rsp,
+	}
+
+	switch {
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 400:
+		var dest BadRequest
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON400 = &dest
+
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 500:
+		var dest InternalServerError
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON500 = &dest
+
+	}
+
+	return response, nil
+}
+
+// ParseListContextsResponse parses an HTTP response from a ListContextsWithResponse call
+func ParseListContextsResponse(rsp *http.Response) (*ListContextsResponse, error) {
+	bodyBytes, err := io.ReadAll(rsp.Body)
+	defer func() { _ = rsp.Body.Close() }()
+	if err != nil {
+		return nil, err
+	}
+
+	response := &ListContextsResponse{
+		Body:         bodyBytes,
+		HTTPResponse: rsp,
+	}
+
+	switch {
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 200:
+		var dest []CodeContext
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON200 = &dest
+
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 400:
+		var dest BadRequest
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON400 = &dest
+
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 500:
+		var dest InternalServerError
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON500 = &dest
+
+	}
+
+	return response, nil
+}
+
+// ParseDeleteContextResponse parses an HTTP response from a DeleteContextWithResponse call
+func ParseDeleteContextResponse(rsp *http.Response) (*DeleteContextResponse, error) {
+	bodyBytes, err := io.ReadAll(rsp.Body)
+	defer func() { _ = rsp.Body.Close() }()
+	if err != nil {
+		return nil, err
+	}
+
+	response := &DeleteContextResponse{
+		Body:         bodyBytes,
+		HTTPResponse: rsp,
+	}
+
+	switch {
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 400:
+		var dest BadRequest
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON400 = &dest
+
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 404:
+		var dest NotFound
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON404 = &dest
+
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 500:
+		var dest InternalServerError
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON500 = &dest
+
+	}
+
+	return response, nil
+}
+
+// ParseGetContextResponse parses an HTTP response from a GetContextWithResponse call
+func ParseGetContextResponse(rsp *http.Response) (*GetContextResponse, error) {
+	bodyBytes, err := io.ReadAll(rsp.Body)
+	defer func() { _ = rsp.Body.Close() }()
+	if err != nil {
+		return nil, err
+	}
+
+	response := &GetContextResponse{
+		Body:         bodyBytes,
+		HTTPResponse: rsp,
+	}
+
+	switch {
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 200:
+		var dest CodeContext
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON200 = &dest
+
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 404:
+		var dest NotFound
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON404 = &dest
+
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 500:
+		var dest InternalServerError
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON500 = &dest
+
+	}
+
+	return response, nil
+}
+
+// ParseInterruptCommandResponse parses an HTTP response from a InterruptCommandWithResponse call
+func ParseInterruptCommandResponse(rsp *http.Response) (*InterruptCommandResponse, error) {
+	bodyBytes, err := io.ReadAll(rsp.Body)
+	defer func() { _ = rsp.Body.Close() }()
+	if err != nil {
+		return nil, err
+	}
+
+	response := &InterruptCommandResponse{
+		Body:         bodyBytes,
+		HTTPResponse: rsp,
+	}
+
+	switch {
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 400:
+		var dest BadRequest
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON400 = &dest
+
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 500:
+		var dest InternalServerError
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON500 = &dest
+
+	}
+
+	return response, nil
+}
+
+// ParseRunCommandResponse parses an HTTP response from a RunCommandWithResponse call
+func ParseRunCommandResponse(rsp *http.Response) (*RunCommandResponse, error) {
+	bodyBytes, err := io.ReadAll(rsp.Body)
+	defer func() { _ = rsp.Body.Close() }()
+	if err != nil {
+		return nil, err
+	}
+
+	response := &RunCommandResponse{
+		Body:         bodyBytes,
+		HTTPResponse: rsp,
+	}
+
+	switch {
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 400:
+		var dest BadRequest
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON400 = &dest
+
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 500:
+		var dest InternalServerError
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON500 = &dest
+
+	}
+
+	return response, nil
+}
+
+// ParseGetCommandStatusResponse parses an HTTP response from a GetCommandStatusWithResponse call
+func ParseGetCommandStatusResponse(rsp *http.Response) (*GetCommandStatusResponse, error) {
+	bodyBytes, err := io.ReadAll(rsp.Body)
+	defer func() { _ = rsp.Body.Close() }()
+	if err != nil {
+		return nil, err
+	}
+
+	response := &GetCommandStatusResponse{
+		Body:         bodyBytes,
+		HTTPResponse: rsp,
+	}
+
+	switch {
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 200:
+		var dest CommandStatusResponse
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON200 = &dest
+
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 400:
+		var dest BadRequest
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON400 = &dest
+
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 404:
+		var dest NotFound
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON404 = &dest
+
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 500:
+		var dest InternalServerError
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON500 = &dest
+
+	}
+
+	return response, nil
+}
+
+// ParseGetBackgroundCommandLogsResponse parses an HTTP response from a GetBackgroundCommandLogsWithResponse call
+func ParseGetBackgroundCommandLogsResponse(rsp *http.Response) (*GetBackgroundCommandLogsResponse, error) {
+	bodyBytes, err := io.ReadAll(rsp.Body)
+	defer func() { _ = rsp.Body.Close() }()
+	if err != nil {
+		return nil, err
+	}
+
+	response := &GetBackgroundCommandLogsResponse{
+		Body:         bodyBytes,
+		HTTPResponse: rsp,
+	}
+
+	switch {
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 400:
+		var dest BadRequest
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON400 = &dest
+
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 404:
+		var dest NotFound
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON404 = &dest
+
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 500:
+		var dest InternalServerError
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON500 = &dest
+
+	}
+
+	return response, nil
+}
+
+// ParseRemoveDirsResponse parses an HTTP response from a RemoveDirsWithResponse call
+func ParseRemoveDirsResponse(rsp *http.Response) (*RemoveDirsResponse, error) {
+	bodyBytes, err := io.ReadAll(rsp.Body)
+	defer func() { _ = rsp.Body.Close() }()
+	if err != nil {
+		return nil, err
+	}
+
+	response := &RemoveDirsResponse{
+		Body:         bodyBytes,
+		HTTPResponse: rsp,
+	}
+
+	switch {
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 500:
+		var dest InternalServerError
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON500 = &dest
+
+	}
+
+	return response, nil
+}
+
+// ParseMakeDirsResponse parses an HTTP response from a MakeDirsWithResponse call
+func ParseMakeDirsResponse(rsp *http.Response) (*MakeDirsResponse, error) {
+	bodyBytes, err := io.ReadAll(rsp.Body)
+	defer func() { _ = rsp.Body.Close() }()
+	if err != nil {
+		return nil, err
+	}
+
+	response := &MakeDirsResponse{
+		Body:         bodyBytes,
+		HTTPResponse: rsp,
+	}
+
+	switch {
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 400:
+		var dest BadRequest
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON400 = &dest
+
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 500:
+		var dest InternalServerError
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON500 = &dest
+
+	}
+
+	return response, nil
+}
+
+// ParseRemoveFilesResponse parses an HTTP response from a RemoveFilesWithResponse call
+func ParseRemoveFilesResponse(rsp *http.Response) (*RemoveFilesResponse, error) {
+	bodyBytes, err := io.ReadAll(rsp.Body)
+	defer func() { _ = rsp.Body.Close() }()
+	if err != nil {
+		return nil, err
+	}
+
+	response := &RemoveFilesResponse{
+		Body:         bodyBytes,
+		HTTPResponse: rsp,
+	}
+
+	switch {
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 500:
+		var dest InternalServerError
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON500 = &dest
+
+	}
+
+	return response, nil
+}
+
+// ParseDownloadFileResponse parses an HTTP response from a DownloadFileWithResponse call
+func ParseDownloadFileResponse(rsp *http.Response) (*DownloadFileResponse, error) {
+	bodyBytes, err := io.ReadAll(rsp.Body)
+	defer func() { _ = rsp.Body.Close() }()
+	if err != nil {
+		return nil, err
+	}
+
+	response := &DownloadFileResponse{
+		Body:         bodyBytes,
+		HTTPResponse: rsp,
+	}
+
+	switch {
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 400:
+		var dest BadRequest
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON400 = &dest
+
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 404:
+		var dest NotFound
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON404 = &dest
+
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 416:
+		var dest ErrorResponse
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON416 = &dest
+
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 500:
+		var dest InternalServerError
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON500 = &dest
+
+	}
+
+	return response, nil
+}
+
+// ParseGetFilesInfoResponse parses an HTTP response from a GetFilesInfoWithResponse call
+func ParseGetFilesInfoResponse(rsp *http.Response) (*GetFilesInfoResponse, error) {
+	bodyBytes, err := io.ReadAll(rsp.Body)
+	defer func() { _ = rsp.Body.Close() }()
+	if err != nil {
+		return nil, err
+	}
+
+	response := &GetFilesInfoResponse{
+		Body:         bodyBytes,
+		HTTPResponse: rsp,
+	}
+
+	switch {
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 200:
+		var dest map[string]FileInfo
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON200 = &dest
+
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 404:
+		var dest NotFound
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON404 = &dest
+
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 500:
+		var dest InternalServerError
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON500 = &dest
+
+	}
+
+	return response, nil
+}
+
+// ParseRenameFilesResponse parses an HTTP response from a RenameFilesWithResponse call
+func ParseRenameFilesResponse(rsp *http.Response) (*RenameFilesResponse, error) {
+	bodyBytes, err := io.ReadAll(rsp.Body)
+	defer func() { _ = rsp.Body.Close() }()
+	if err != nil {
+		return nil, err
+	}
+
+	response := &RenameFilesResponse{
+		Body:         bodyBytes,
+		HTTPResponse: rsp,
+	}
+
+	switch {
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 400:
+		var dest BadRequest
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON400 = &dest
+
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 404:
+		var dest NotFound
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON404 = &dest
+
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 500:
+		var dest InternalServerError
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON500 = &dest
+
+	}
+
+	return response, nil
+}
+
+// ParseChmodFilesResponse parses an HTTP response from a ChmodFilesWithResponse call
+func ParseChmodFilesResponse(rsp *http.Response) (*ChmodFilesResponse, error) {
+	bodyBytes, err := io.ReadAll(rsp.Body)
+	defer func() { _ = rsp.Body.Close() }()
+	if err != nil {
+		return nil, err
+	}
+
+	response := &ChmodFilesResponse{
+		Body:         bodyBytes,
+		HTTPResponse: rsp,
+	}
+
+	switch {
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 400:
+		var dest BadRequest
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON400 = &dest
+
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 500:
+		var dest InternalServerError
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON500 = &dest
+
+	}
+
+	return response, nil
+}
+
+// ParseReplaceContentResponse parses an HTTP response from a ReplaceContentWithResponse call
+func ParseReplaceContentResponse(rsp *http.Response) (*ReplaceContentResponse, error) {
+	bodyBytes, err := io.ReadAll(rsp.Body)
+	defer func() { _ = rsp.Body.Close() }()
+	if err != nil {
+		return nil, err
+	}
+
+	response := &ReplaceContentResponse{
+		Body:         bodyBytes,
+		HTTPResponse: rsp,
+	}
+
+	switch {
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 400:
+		var dest BadRequest
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON400 = &dest
+
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 500:
+		var dest InternalServerError
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON500 = &dest
+
+	}
+
+	return response, nil
+}
+
+// ParseSearchFilesResponse parses an HTTP response from a SearchFilesWithResponse call
+func ParseSearchFilesResponse(rsp *http.Response) (*SearchFilesResponse, error) {
+	bodyBytes, err := io.ReadAll(rsp.Body)
+	defer func() { _ = rsp.Body.Close() }()
+	if err != nil {
+		return nil, err
+	}
+
+	response := &SearchFilesResponse{
+		Body:         bodyBytes,
+		HTTPResponse: rsp,
+	}
+
+	switch {
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 200:
+		var dest []FileInfo
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON200 = &dest
+
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 400:
+		var dest BadRequest
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON400 = &dest
+
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 404:
+		var dest NotFound
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON404 = &dest
+
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 500:
+		var dest InternalServerError
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON500 = &dest
+
+	}
+
+	return response, nil
+}
+
+// ParseUploadFileResponse parses an HTTP response from a UploadFileWithResponse call
+func ParseUploadFileResponse(rsp *http.Response) (*UploadFileResponse, error) {
+	bodyBytes, err := io.ReadAll(rsp.Body)
+	defer func() { _ = rsp.Body.Close() }()
+	if err != nil {
+		return nil, err
+	}
+
+	response := &UploadFileResponse{
+		Body:         bodyBytes,
+		HTTPResponse: rsp,
+	}
+
+	switch {
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 400:
+		var dest BadRequest
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON400 = &dest
+
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 500:
+		var dest InternalServerError
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON500 = &dest
+
+	}
+
+	return response, nil
+}
+
+// ParseGetMetricsResponse parses an HTTP response from a GetMetricsWithResponse call
+func ParseGetMetricsResponse(rsp *http.Response) (*GetMetricsResponse, error) {
+	bodyBytes, err := io.ReadAll(rsp.Body)
+	defer func() { _ = rsp.Body.Close() }()
+	if err != nil {
+		return nil, err
+	}
+
+	response := &GetMetricsResponse{
+		Body:         bodyBytes,
+		HTTPResponse: rsp,
+	}
+
+	switch {
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 200:
+		var dest Metrics
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON200 = &dest
+
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 500:
+		var dest InternalServerError
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON500 = &dest
+
+	}
+
+	return response, nil
+}
+
+// ParseWatchMetricsResponse parses an HTTP response from a WatchMetricsWithResponse call
+func ParseWatchMetricsResponse(rsp *http.Response) (*WatchMetricsResponse, error) {
+	bodyBytes, err := io.ReadAll(rsp.Body)
+	defer func() { _ = rsp.Body.Close() }()
+	if err != nil {
+		return nil, err
+	}
+
+	response := &WatchMetricsResponse{
+		Body:         bodyBytes,
+		HTTPResponse: rsp,
+	}
+
+	switch {
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 500:
+		var dest InternalServerError
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON500 = &dest
+
+	}
+
+	return response, nil
+}
+
+// ParsePingResponse parses an HTTP response from a PingWithResponse call
+func ParsePingResponse(rsp *http.Response) (*PingResponse, error) {
+	bodyBytes, err := io.ReadAll(rsp.Body)
+	defer func() { _ = rsp.Body.Close() }()
+	if err != nil {
+		return nil, err
+	}
+
+	response := &PingResponse{
+		Body:         bodyBytes,
+		HTTPResponse: rsp,
+	}
+
+	return response, nil
+}
+
+// ParseCreateSessionResponse parses an HTTP response from a CreateSessionWithResponse call
+func ParseCreateSessionResponse(rsp *http.Response) (*CreateSessionResponse, error) {
+	bodyBytes, err := io.ReadAll(rsp.Body)
+	defer func() { _ = rsp.Body.Close() }()
+	if err != nil {
+		return nil, err
+	}
+
+	response := &CreateSessionResponse{
+		Body:         bodyBytes,
+		HTTPResponse: rsp,
+	}
+
+	switch {
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 200:
+		var dest SessionCreated
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON200 = &dest
+
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 400:
+		var dest BadRequest
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON400 = &dest
+
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 500:
+		var dest InternalServerError
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON500 = &dest
+
+	}
+
+	return response, nil
+}
+
+// ParseDeleteSessionResponse parses an HTTP response from a DeleteSessionWithResponse call
+func ParseDeleteSessionResponse(rsp *http.Response) (*DeleteSessionResponse, error) {
+	bodyBytes, err := io.ReadAll(rsp.Body)
+	defer func() { _ = rsp.Body.Close() }()
+	if err != nil {
+		return nil, err
+	}
+
+	response := &DeleteSessionResponse{
+		Body:         bodyBytes,
+		HTTPResponse: rsp,
+	}
+
+	switch {
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 400:
+		var dest BadRequest
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON400 = &dest
+
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 404:
+		var dest NotFound
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON404 = &dest
+
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 500:
+		var dest InternalServerError
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON500 = &dest
+
+	}
+
+	return response, nil
+}
+
+// ParseRunInSessionResponse parses an HTTP response from a RunInSessionWithResponse call
+func ParseRunInSessionResponse(rsp *http.Response) (*RunInSessionResponse, error) {
+	bodyBytes, err := io.ReadAll(rsp.Body)
+	defer func() { _ = rsp.Body.Close() }()
+	if err != nil {
+		return nil, err
+	}
+
+	response := &RunInSessionResponse{
+		Body:         bodyBytes,
+		HTTPResponse: rsp,
+	}
+
+	switch {
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 400:
+		var dest BadRequest
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON400 = &dest
+
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 500:
+		var dest InternalServerError
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON500 = &dest
+
+	}
+
+	return response, nil
+}
diff --git a/sdks/sandbox/go/opensandbox/api/execd/generate.go b/sdks/sandbox/go/opensandbox/api/execd/generate.go
new file mode 100644
index 00000000..cdd8c691
--- /dev/null
+++ b/sdks/sandbox/go/opensandbox/api/execd/generate.go
@@ -0,0 +1,3 @@
+package execd
+
+//go:generate oapi-codegen --config cfg.yaml ../specs/execd-api.yaml
diff --git a/sdks/sandbox/go/opensandbox/api/lifecycle/cfg.yaml b/sdks/sandbox/go/opensandbox/api/lifecycle/cfg.yaml
new file mode 100644
index 00000000..e6c26b89
--- /dev/null
+++ b/sdks/sandbox/go/opensandbox/api/lifecycle/cfg.yaml
@@ -0,0 +1,7 @@
+package: lifecycle
+output: gen.go
+generate:
+  models: true
+  client: true
+output-options:
+  name-normalizer: ToCamelCaseWithInitialisms
diff --git a/sdks/sandbox/go/opensandbox/api/lifecycle/gen.go b/sdks/sandbox/go/opensandbox/api/lifecycle/gen.go
new file mode 100644
index 00000000..f61d0c98
--- /dev/null
+++ b/sdks/sandbox/go/opensandbox/api/lifecycle/gen.go
@@ -0,0 +1,1954 @@
+// Package lifecycle provides primitives to interact with the openapi HTTP API.
+//
+// Code generated by github.com/oapi-codegen/oapi-codegen/v2 version v2.6.0 DO NOT EDIT.
+package lifecycle
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"strings"
+	"time"
+
+	"github.com/oapi-codegen/runtime"
+)
+
+const (
+	ApiKeyAuthScopes = "apiKeyAuth.Scopes"
+)
+
+// Defines values for NetworkPolicyDefaultAction.
+const (
+	NetworkPolicyDefaultActionAllow NetworkPolicyDefaultAction = "allow"
+	NetworkPolicyDefaultActionDeny  NetworkPolicyDefaultAction = "deny"
+)
+
+// Valid indicates whether the value is a known member of the NetworkPolicyDefaultAction enum.
+func (e NetworkPolicyDefaultAction) Valid() bool {
+	switch e {
+	case NetworkPolicyDefaultActionAllow:
+		return true
+	case NetworkPolicyDefaultActionDeny:
+		return true
+	default:
+		return false
+	}
+}
+
+// Defines values for NetworkRuleAction.
+const (
+	NetworkRuleActionAllow NetworkRuleAction = "allow"
+	NetworkRuleActionDeny  NetworkRuleAction = "deny"
+)
+
+// Valid indicates whether the value is a known member of the NetworkRuleAction enum.
+func (e NetworkRuleAction) Valid() bool {
+	switch e {
+	case NetworkRuleActionAllow:
+		return true
+	case NetworkRuleActionDeny:
+		return true
+	default:
+		return false
+	}
+}
+
+// Defines values for OSSFSVersion.
+const (
+	N10 OSSFSVersion = "1.0"
+	N20 OSSFSVersion = "2.0"
+)
+
+// Valid indicates whether the value is a known member of the OSSFSVersion enum.
+func (e OSSFSVersion) Valid() bool {
+	switch e {
+	case N10:
+		return true
+	case N20:
+		return true
+	default:
+		return false
+	}
+}
+
+// CreateSandboxRequest Request to create a new sandbox from a container image.
+//
+// **Note**: API Key authentication is required via the `OPEN-SANDBOX-API-KEY` header.
+type CreateSandboxRequest struct {
+	// Entrypoint The command to execute as the sandbox's entry process (required).
+	//
+	// Explicitly specifies the user's expected main process, allowing the sandbox management
+	// service to reliably inject control processes before executing this command.
+	//
+	// Format: [executable, arg1, arg2, ...]
+	//
+	// Examples:
+	// - ["python", "/app/main.py"]
+	// - ["/bin/bash"]
+	// - ["java", "-jar", "/app/app.jar"]
+	// - ["node", "server.js"]
+	Entrypoint []string `json:"entrypoint"`
+
+	// Env Environment variables to inject into the sandbox runtime.
+	Env *map[string]string `json:"env,omitempty"`
+
+	// Extensions Opaque container for provider-specific or transient parameters not supported by the core API.
+	//
+	// **Note**: This field is reserved for internal features, experimental flags, or temporary behaviors. Standard parameters should be proposed as core API fields.
+	//
+	// **Best Practices**:
+	// - **Namespacing**: Use prefixed keys (e.g., `storage.id`) to prevent collisions.
+	// - **Pass-through**: SDKs and middleware must treat this object as opaque and pass it through transparently.
+	//
+	// **Well-known keys**:
+	// - `access.renew.extend.seconds` (optional): Decimal integer string from **300** to **86400** (5 minutes to 24 hours inclusive). Opts the sandbox into OSEP-0009 renew-on-access and sets per-renewal extension seconds. Omit to disable. Invalid values are rejected at creation with HTTP 400 (validated on the lifecycle create endpoint via `validate_extensions` in server `src/extensions/validation.py`).
+	Extensions *map[string]string `json:"extensions,omitempty"`
+
+	// Image Container image specification for sandbox provisioning.
+	//
+	// Supports public registry images and private registry images with authentication.
+	Image ImageSpec `json:"image"`
+
+	// Metadata Custom key-value metadata for management, filtering, and tagging.
+	// Use "name" key for a human-readable identifier.
+	Metadata *map[string]string `json:"metadata,omitempty"`
+
+	// NetworkPolicy Egress network policy matching the sidecar `/policy` request body.
+	// If `defaultAction` is omitted, the sidecar defaults to "deny"; passing an empty
+	// object or null results in allow-all behavior at startup.
+	NetworkPolicy *NetworkPolicy `json:"networkPolicy,omitempty"`
+
+	// ResourceLimits Runtime resource constraints as key-value pairs. Similar to Kubernetes resource specifications,
+	// allows flexible definition of resource limits. Common resource types include:
+	// - `cpu`: CPU allocation in millicores (e.g., "250m" for 0.25 CPU cores)
+	// - `memory`: Memory allocation in bytes or human-readable format (e.g., "512Mi", "1Gi")
+	// - `gpu`: Number of GPU devices (e.g., "1")
+	//
+	// New resource types can be added without API changes.
+	ResourceLimits ResourceLimits `json:"resourceLimits"`
+
+	// Timeout Sandbox timeout in seconds. The sandbox will automatically terminate after this duration.
+	// The maximum is controlled by the server configuration (`server.max_sandbox_timeout_seconds`).
+	// Omit this field or set it to null to disable automatic expiration and require explicit cleanup.
+	// Note: manual cleanup support is runtime-dependent; Kubernetes providers may reject
+	// omitted or null timeout when the underlying workload provider does not support non-expiring sandboxes.
+	Timeout *int `json:"timeout,omitempty"`
+
+	// Volumes Storage mounts for the sandbox. Each volume entry specifies a named backend-specific
+	// storage source and common mount settings. Exactly one backend type must be specified
+	// per volume entry.
+	Volumes *[]Volume `json:"volumes,omitempty"`
+}
+
+// CreateSandboxResponse Response from creating a new sandbox. Contains essential information without image and updatedAt.
+type CreateSandboxResponse struct {
+	// CreatedAt Sandbox creation timestamp
+	CreatedAt time.Time `json:"createdAt"`
+
+	// Entrypoint Entry process specification from creation request
+	Entrypoint []string `json:"entrypoint"`
+
+	// ExpiresAt Timestamp when sandbox will auto-terminate. Omitted when manual cleanup is enabled.
+	ExpiresAt *time.Time `json:"expiresAt,omitempty"`
+
+	// ID Unique sandbox identifier
+	ID string `json:"id"`
+
+	// Metadata Custom metadata from creation request
+	Metadata *map[string]string `json:"metadata,omitempty"`
+
+	// Status Detailed status information with lifecycle state and transition details
+	Status SandboxStatus `json:"status"`
+}
+
+// Endpoint Endpoint for accessing a service running in the sandbox.
+// The service must be listening on the specified port inside the sandbox for the endpoint to be available.
+type Endpoint struct {
+	// Endpoint Public URL to access the service from outside the sandbox.
+	// Format: {endpoint-host}/sandboxes/{sandboxId}/port/{port}
+	// Example: endpoint.opensandbox.io/sandboxes/abc123/port/8080
+	Endpoint string `json:"endpoint"`
+
+	// Headers Requests targeting the sandbox must include the corresponding header(s).
+	Headers *map[string]string `json:"headers,omitempty"`
+}
+
+// ErrorResponse Standard error response for all non-2xx HTTP responses.
+// HTTP status code indicates the error category; code and message provide details.
+type ErrorResponse struct {
+	// Code Machine-readable error code (e.g., INVALID_REQUEST, NOT_FOUND, INTERNAL_ERROR).
+	// Use this for programmatic error handling.
+	Code string `json:"code"`
+
+	// Message Human-readable error message describing what went wrong and how to fix it.
+	Message string `json:"message"`
+}
+
+// Host Host path bind mount backend. Maps a directory on the host filesystem
+// into the container. Only available when the runtime supports host mounts.
+//
+// Security note: Host paths are restricted by server-side allowlist.
+// Users must specify paths under permitted prefixes.
+type Host struct {
+	// Path Absolute path on the host filesystem to mount.
+	// Must start with '/' and be under an allowed prefix.
+	Path string `json:"path"`
+}
+
+// ImageSpec Container image specification for sandbox provisioning.
+//
+// Supports public registry images and private registry images with authentication.
+type ImageSpec struct {
+	// Auth Registry authentication credentials (required for private registries)
+	Auth *struct {
+		// Password Registry password or authentication token
+		Password *string `json:"password,omitempty"`
+
+		// Username Registry username or service account
+		Username *string `json:"username,omitempty"`
+	} `json:"auth,omitempty"`
+
+	// URI Container image URI in standard format.
+	//
+	// Examples:
+	//   - "python:3.11" (Docker Hub)
+	//   - "ubuntu:22.04"
+	//   - "gcr.io/my-project/model-server:v1.0"
+	//   - "private-registry.company.com:5000/app:latest"
+	URI string `json:"uri"`
+}
+
+// ListSandboxesResponse defines model for ListSandboxesResponse.
+type ListSandboxesResponse struct {
+	Items []Sandbox `json:"items"`
+
+	// Pagination Pagination metadata for list responses
+	Pagination PaginationInfo `json:"pagination"`
+}
+
+// NetworkPolicy Egress network policy matching the sidecar `/policy` request body.
+// If `defaultAction` is omitted, the sidecar defaults to "deny"; passing an empty
+// object or null results in allow-all behavior at startup.
+type NetworkPolicy struct {
+	// DefaultAction Default action when no egress rule matches. Defaults to "deny".
+	DefaultAction *NetworkPolicyDefaultAction `json:"defaultAction,omitempty"`
+
+	// Egress List of egress rules evaluated in order.
+	Egress *[]NetworkRule `json:"egress,omitempty"`
+}
+
+// NetworkPolicyDefaultAction Default action when no egress rule matches. Defaults to "deny".
+type NetworkPolicyDefaultAction string
+
+// NetworkRule defines model for NetworkRule.
+type NetworkRule struct {
+	// Action Whether to allow or deny matching targets.
+	Action NetworkRuleAction `json:"action"`
+
+	// Target FQDN or wildcard domain (e.g., "example.com", "*.example.com").
+	// IP/CIDR not yet supported in the egress MVP.
+	Target string `json:"target"`
+}
+
+// NetworkRuleAction Whether to allow or deny matching targets.
+type NetworkRuleAction string
+
+// OSSFS Alibaba Cloud OSS mount backend via ossfs.
+//
+// The runtime mounts a host-side OSS path under `storage.ossfs_mount_root`
+// and bind-mounts the resolved path into the sandbox container.
+// Prefix selection is expressed via `Volume.subPath`.
+// In Docker runtime, OSSFS backend requires OpenSandbox Server to run on a Linux host with FUSE support.
+type OSSFS struct {
+	// AccessKeyID OSS access key ID for inline credentials mode.
+	AccessKeyID string `json:"accessKeyId"`
+
+	// AccessKeySecret OSS access key secret for inline credentials mode.
+	AccessKeySecret string `json:"accessKeySecret"`
+
+	// Bucket OSS bucket name.
+	Bucket string `json:"bucket"`
+
+	// Endpoint OSS endpoint (e.g., `oss-cn-hangzhou.aliyuncs.com`).
+	Endpoint string `json:"endpoint"`
+
+	// Options Additional ossfs mount options.
+	// Runtime encodes options by `version`:
+	// - `1.0`: mounts with `ossfs ... -o <option>`
+	// - `2.0`: mounts with `ossfs2 mount ... -c <config-file>` and encodes options as `--<option>` lines in the config file
+	// Option values must be provided as raw payloads without leading `-`.
+	Options *[]string `json:"options,omitempty"`
+
+	// Version ossfs major version used by runtime mount integration.
+	Version *OSSFSVersion `json:"version,omitempty"`
+}
+
+// OSSFSVersion ossfs major version used by runtime mount integration.
+type OSSFSVersion string
+
+// PVC Platform-managed named volume backend. A runtime-neutral abstraction
+// for referencing a pre-existing, platform-managed named volume.
+//
+// - Kubernetes: maps to a PersistentVolumeClaim in the same namespace.
+// - Docker: maps to a Docker named volume (created via `docker volume create`).
+//
+// The volume must already exist on the target platform before sandbox
+// creation.
+type PVC struct {
+	// ClaimName Name of the volume on the target platform.
+	// In Kubernetes this is the PVC name; in Docker this is the named
+	// volume name. Must be a valid DNS label.
+	ClaimName string `json:"claimName"`
+}
+
+// PaginationInfo Pagination metadata for list responses
+type PaginationInfo struct {
+	// HasNextPage Whether there are more pages after the current one
+	HasNextPage bool `json:"hasNextPage"`
+
+	// Page Current page number
+	Page int `json:"page"`
+
+	// PageSize Number of items per page
+	PageSize int `json:"pageSize"`
+
+	// TotalItems Total number of items matching the filter
+	TotalItems int `json:"totalItems"`
+
+	// TotalPages Total number of pages
+	TotalPages int `json:"totalPages"`
+}
+
+// RenewSandboxExpirationRequest defines model for RenewSandboxExpirationRequest.
+type RenewSandboxExpirationRequest struct {
+	// ExpiresAt New absolute expiration time in UTC (RFC 3339 format).
+	// Must be in the future and after the current expiresAt time.
+	//
+	// Example: "2025-11-16T14:30:45Z"
+	ExpiresAt time.Time `json:"expiresAt"`
+}
+
+// RenewSandboxExpirationResponse defines model for RenewSandboxExpirationResponse.
+type RenewSandboxExpirationResponse struct {
+	// ExpiresAt The new absolute expiration time in UTC (RFC 3339 format).
+	//
+	// Example: "2025-11-16T14:30:45Z"
+	ExpiresAt time.Time `json:"expiresAt"`
+}
+
+// ResourceLimits Runtime resource constraints as key-value pairs. Similar to Kubernetes resource specifications,
+// allows flexible definition of resource limits. Common resource types include:
+// - `cpu`: CPU allocation in millicores (e.g., "250m" for 0.25 CPU cores)
+// - `memory`: Memory allocation in bytes or human-readable format (e.g., "512Mi", "1Gi")
+// - `gpu`: Number of GPU devices (e.g., "1")
+//
+// New resource types can be added without API changes.
+type ResourceLimits map[string]string
+
+// Sandbox Runtime execution environment provisioned from a container image
+type Sandbox struct {
+	// CreatedAt Sandbox creation timestamp
+	CreatedAt time.Time `json:"createdAt"`
+
+	// Entrypoint The command to execute as the sandbox's entry process.
+	// Always present in responses since entrypoint is required in creation requests.
+	Entrypoint []string `json:"entrypoint"`
+
+	// ExpiresAt Timestamp when sandbox will auto-terminate. Omitted when manual cleanup is enabled.
+	ExpiresAt *time.Time `json:"expiresAt,omitempty"`
+
+	// ID Unique sandbox identifier
+	ID string `json:"id"`
+
+	// Image Container image specification for sandbox provisioning.
+	//
+	// Supports public registry images and private registry images with authentication.
+	Image ImageSpec `json:"image"`
+
+	// Metadata Custom metadata from creation request
+	Metadata *map[string]string `json:"metadata,omitempty"`
+
+	// Status Detailed status information with lifecycle state and transition details
+	Status SandboxStatus `json:"status"`
+}
+
+// SandboxState High-level lifecycle state of the sandbox.
+//
+// Common state values:
+// - Pending: Sandbox is being provisioned
+// - Running: Sandbox is running and ready to accept requests
+// - Pausing: Sandbox is in the process of pausing
+// - Paused: Sandbox has been paused while retaining its state
+// - Stopping: Sandbox is being terminated
+// - Terminated: Sandbox has been successfully terminated
+// - Failed: Sandbox encountered a critical error
+//
+// State transitions:
+// - Pending → Running (after creation completes)
+// - Running → Pausing (when pause is requested)
+// - Pausing → Paused (pause operation completes)
+// - Paused → Running (when resume is requested)
+// - Running/Paused → Stopping (when kill is requested or TTL expires)
+// - Stopping → Terminated (kill/timeout operation completes)
+// - Pending/Running/Paused → Failed (on error)
+//
+// Note: New state values may be added in future versions.
+// Clients should handle unknown state values gracefully.
+type SandboxState = string
+
+// SandboxStatus Detailed status information with lifecycle state and transition details
+type SandboxStatus struct {
+	// LastTransitionAt Timestamp of the last state transition
+	LastTransitionAt *time.Time `json:"lastTransitionAt,omitempty"`
+
+	// Message Human-readable message describing the current state or reason for state transition
+	Message *string `json:"message,omitempty"`
+
+	// Reason Short machine-readable reason code for the current state.
+	// Examples: "user_delete", "ttl_expiry", "provision_timeout", "runtime_error"
+	Reason *string `json:"reason,omitempty"`
+
+	// State High-level lifecycle state of the sandbox.
+	//
+	// Common state values:
+	// - Pending: Sandbox is being provisioned
+	// - Running: Sandbox is running and ready to accept requests
+	// - Pausing: Sandbox is in the process of pausing
+	// - Paused: Sandbox has been paused while retaining its state
+	// - Stopping: Sandbox is being terminated
+	// - Terminated: Sandbox has been successfully terminated
+	// - Failed: Sandbox encountered a critical error
+	//
+	// State transitions:
+	// - Pending → Running (after creation completes)
+	// - Running → Pausing (when pause is requested)
+	// - Pausing → Paused (pause operation completes)
+	// - Paused → Running (when resume is requested)
+	// - Running/Paused → Stopping (when kill is requested or TTL expires)
+	// - Stopping → Terminated (kill/timeout operation completes)
+	// - Pending/Running/Paused → Failed (on error)
+	//
+	// Note: New state values may be added in future versions.
+	// Clients should handle unknown state values gracefully.
+	State SandboxState `json:"state"`
+}
+
+// Volume Storage mount definition for a sandbox. Each volume entry contains:
+// - A unique name identifier
+// - Exactly one backend struct (host, pvc, ossfs, etc.) with backend-specific fields
+// - Common mount settings (mountPath, readOnly, subPath)
+type Volume struct {
+	// Host Host path bind mount backend. Maps a directory on the host filesystem
+	// into the container. Only available when the runtime supports host mounts.
+	//
+	// Security note: Host paths are restricted by server-side allowlist.
+	// Users must specify paths under permitted prefixes.
+	Host *Host `json:"host,omitempty"`
+
+	// MountPath Absolute path inside the container where the volume is mounted.
+	// Must start with '/'.
+	MountPath string `json:"mountPath"`
+
+	// Name Unique identifier for the volume within the sandbox.
+	// Must be a valid DNS label (lowercase alphanumeric, hyphens allowed, max 63 chars).
+	Name string `json:"name"`
+
+	// Ossfs Alibaba Cloud OSS mount backend via ossfs.
+	//
+	// The runtime mounts a host-side OSS path under `storage.ossfs_mount_root`
+	// and bind-mounts the resolved path into the sandbox container.
+	// Prefix selection is expressed via `Volume.subPath`.
+	// In Docker runtime, OSSFS backend requires OpenSandbox Server to run on a Linux host with FUSE support.
+	Ossfs *OSSFS `json:"ossfs,omitempty"`
+
+	// Pvc Platform-managed named volume backend. A runtime-neutral abstraction
+	// for referencing a pre-existing, platform-managed named volume.
+	//
+	// - Kubernetes: maps to a PersistentVolumeClaim in the same namespace.
+	// - Docker: maps to a Docker named volume (created via `docker volume create`).
+	//
+	// The volume must already exist on the target platform before sandbox
+	// creation.
+	Pvc *PVC `json:"pvc,omitempty"`
+
+	// ReadOnly If true, the volume is mounted as read-only. Defaults to false (read-write).
+	ReadOnly *bool `json:"readOnly,omitempty"`
+
+	// SubPath Optional subdirectory under the backend path to mount.
+	// For `ossfs` backend, this field is used as the bucket prefix.
+	// Must be a relative path without '..' components.
+	SubPath *string `json:"subPath,omitempty"`
+}
+
+// SandboxID defines model for SandboxId.
+type SandboxID = string
+
+// BadRequest Standard error response for all non-2xx HTTP responses.
+// HTTP status code indicates the error category; code and message provide details.
+type BadRequest = ErrorResponse
+
+// Conflict Standard error response for all non-2xx HTTP responses.
+// HTTP status code indicates the error category; code and message provide details.
+type Conflict = ErrorResponse
+
+// Forbidden Standard error response for all non-2xx HTTP responses.
+// HTTP status code indicates the error category; code and message provide details.
+type Forbidden = ErrorResponse
+
+// InternalServerError Standard error response for all non-2xx HTTP responses.
+// HTTP status code indicates the error category; code and message provide details.
+type InternalServerError = ErrorResponse
+
+// NotFound Standard error response for all non-2xx HTTP responses.
+// HTTP status code indicates the error category; code and message provide details.
+type NotFound = ErrorResponse
+
+// Unauthorized Standard error response for all non-2xx HTTP responses.
+// HTTP status code indicates the error category; code and message provide details.
+type Unauthorized = ErrorResponse
+
+// GetSandboxesParams defines parameters for GetSandboxes.
+type GetSandboxesParams struct {
+	// State Filter by lifecycle state. Pass multiple times for OR logic.
+	// Example: `?state=Running&state=Paused`
+	State *[]string `form:"state,omitempty" json:"state,omitempty"`
+
+	// Metadata Arbitrary metadata key-value pairs for filtering，keys and values must be url encoded
+	// Example: To filter by `project=Apollo` and `note=Demo Test`: `?metadata=project%3DApollo%26note%3DDemo%252520Test`
+	Metadata *string `form:"metadata,omitempty" json:"metadata,omitempty"`
+
+	// Page Page number for pagination
+	Page *int `form:"page,omitempty" json:"page,omitempty"`
+
+	// PageSize Number of items per page
+	PageSize *int `form:"pageSize,omitempty" json:"pageSize,omitempty"`
+}
+
+// GetSandboxesSandboxIDEndpointsPortParams defines parameters for GetSandboxesSandboxIDEndpointsPort.
+type GetSandboxesSandboxIDEndpointsPortParams struct {
+	// UseServerProxy Whether to return a server-proxied URL
+	UseServerProxy *bool `form:"use_server_proxy,omitempty" json:"use_server_proxy,omitempty"`
+}
+
+// PostSandboxesJSONRequestBody defines body for PostSandboxes for application/json ContentType.
+type PostSandboxesJSONRequestBody = CreateSandboxRequest
+
+// PostSandboxesSandboxIDRenewExpirationJSONRequestBody defines body for PostSandboxesSandboxIDRenewExpiration for application/json ContentType.
+type PostSandboxesSandboxIDRenewExpirationJSONRequestBody = RenewSandboxExpirationRequest
+
+// RequestEditorFn  is the function signature for the RequestEditor callback function
+type RequestEditorFn func(ctx context.Context, req *http.Request) error
+
+// Doer performs HTTP requests.
+//
+// The standard http.Client implements this interface.
+type HttpRequestDoer interface {
+	Do(req *http.Request) (*http.Response, error)
+}
+
+// Client which conforms to the OpenAPI3 specification for this service.
+type Client struct {
+	// The endpoint of the server conforming to this interface, with scheme,
+	// https://api.deepmap.com for example. This can contain a path relative
+	// to the server, such as https://api.deepmap.com/dev-test, and all the
+	// paths in the swagger spec will be appended to the server.
+	Server string
+
+	// Doer for performing requests, typically a *http.Client with any
+	// customized settings, such as certificate chains.
+	Client HttpRequestDoer
+
+	// A list of callbacks for modifying requests which are generated before sending over
+	// the network.
+	RequestEditors []RequestEditorFn
+}
+
+// ClientOption allows setting custom parameters during construction
+type ClientOption func(*Client) error
+
+// Creates a new Client, with reasonable defaults
+func NewClient(server string, opts ...ClientOption) (*Client, error) {
+	// create a client with sane default values
+	client := Client{
+		Server: server,
+	}
+	// mutate client and add all optional params
+	for _, o := range opts {
+		if err := o(&client); err != nil {
+			return nil, err
+		}
+	}
+	// ensure the server URL always has a trailing slash
+	if !strings.HasSuffix(client.Server, "/") {
+		client.Server += "/"
+	}
+	// create httpClient, if not already present
+	if client.Client == nil {
+		client.Client = &http.Client{}
+	}
+	return &client, nil
+}
+
+// WithHTTPClient allows overriding the default Doer, which is
+// automatically created using http.Client. This is useful for tests.
+func WithHTTPClient(doer HttpRequestDoer) ClientOption {
+	return func(c *Client) error {
+		c.Client = doer
+		return nil
+	}
+}
+
+// WithRequestEditorFn allows setting up a callback function, which will be
+// called right before sending the request. This can be used to mutate the request.
+func WithRequestEditorFn(fn RequestEditorFn) ClientOption {
+	return func(c *Client) error {
+		c.RequestEditors = append(c.RequestEditors, fn)
+		return nil
+	}
+}
+
+// The interface specification for the client above.
+type ClientInterface interface {
+	// GetSandboxes request
+	GetSandboxes(ctx context.Context, params *GetSandboxesParams, reqEditors ...RequestEditorFn) (*http.Response, error)
+
+	// PostSandboxesWithBody request with any body
+	PostSandboxesWithBody(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*http.Response, error)
+
+	PostSandboxes(ctx context.Context, body PostSandboxesJSONRequestBody, reqEditors ...RequestEditorFn) (*http.Response, error)
+
+	// DeleteSandboxesSandboxID request
+	DeleteSandboxesSandboxID(ctx context.Context, sandboxID SandboxID, reqEditors ...RequestEditorFn) (*http.Response, error)
+
+	// GetSandboxesSandboxID request
+	GetSandboxesSandboxID(ctx context.Context, sandboxID SandboxID, reqEditors ...RequestEditorFn) (*http.Response, error)
+
+	// GetSandboxesSandboxIDEndpointsPort request
+	GetSandboxesSandboxIDEndpointsPort(ctx context.Context, sandboxID SandboxID, port int, params *GetSandboxesSandboxIDEndpointsPortParams, reqEditors ...RequestEditorFn) (*http.Response, error)
+
+	// PostSandboxesSandboxIDPause request
+	PostSandboxesSandboxIDPause(ctx context.Context, sandboxID SandboxID, reqEditors ...RequestEditorFn) (*http.Response, error)
+
+	// PostSandboxesSandboxIDRenewExpirationWithBody request with any body
+	PostSandboxesSandboxIDRenewExpirationWithBody(ctx context.Context, sandboxID SandboxID, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*http.Response, error)
+
+	PostSandboxesSandboxIDRenewExpiration(ctx context.Context, sandboxID SandboxID, body PostSandboxesSandboxIDRenewExpirationJSONRequestBody, reqEditors ...RequestEditorFn) (*http.Response, error)
+
+	// PostSandboxesSandboxIDResume request
+	PostSandboxesSandboxIDResume(ctx context.Context, sandboxID SandboxID, reqEditors ...RequestEditorFn) (*http.Response, error)
+}
+
+func (c *Client) GetSandboxes(ctx context.Context, params *GetSandboxesParams, reqEditors ...RequestEditorFn) (*http.Response, error) {
+	req, err := NewGetSandboxesRequest(c.Server, params)
+	if err != nil {
+		return nil, err
+	}
+	req = req.WithContext(ctx)
+	if err := c.applyEditors(ctx, req, reqEditors); err != nil {
+		return nil, err
+	}
+	return c.Client.Do(req)
+}
+
+func (c *Client) PostSandboxesWithBody(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*http.Response, error) {
+	req, err := NewPostSandboxesRequestWithBody(c.Server, contentType, body)
+	if err != nil {
+		return nil, err
+	}
+	req = req.WithContext(ctx)
+	if err := c.applyEditors(ctx, req, reqEditors); err != nil {
+		return nil, err
+	}
+	return c.Client.Do(req)
+}
+
+func (c *Client) PostSandboxes(ctx context.Context, body PostSandboxesJSONRequestBody, reqEditors ...RequestEditorFn) (*http.Response, error) {
+	req, err := NewPostSandboxesRequest(c.Server, body)
+	if err != nil {
+		return nil, err
+	}
+	req = req.WithContext(ctx)
+	if err := c.applyEditors(ctx, req, reqEditors); err != nil {
+		return nil, err
+	}
+	return c.Client.Do(req)
+}
+
+func (c *Client) DeleteSandboxesSandboxID(ctx context.Context, sandboxID SandboxID, reqEditors ...RequestEditorFn) (*http.Response, error) {
+	req, err := NewDeleteSandboxesSandboxIDRequest(c.Server, sandboxID)
+	if err != nil {
+		return nil, err
+	}
+	req = req.WithContext(ctx)
+	if err := c.applyEditors(ctx, req, reqEditors); err != nil {
+		return nil, err
+	}
+	return c.Client.Do(req)
+}
+
+func (c *Client) GetSandboxesSandboxID(ctx context.Context, sandboxID SandboxID, reqEditors ...RequestEditorFn) (*http.Response, error) {
+	req, err := NewGetSandboxesSandboxIDRequest(c.Server, sandboxID)
+	if err != nil {
+		return nil, err
+	}
+	req = req.WithContext(ctx)
+	if err := c.applyEditors(ctx, req, reqEditors); err != nil {
+		return nil, err
+	}
+	return c.Client.Do(req)
+}
+
+func (c *Client) GetSandboxesSandboxIDEndpointsPort(ctx context.Context, sandboxID SandboxID, port int, params *GetSandboxesSandboxIDEndpointsPortParams, reqEditors ...RequestEditorFn) (*http.Response, error) {
+	req, err := NewGetSandboxesSandboxIDEndpointsPortRequest(c.Server, sandboxID, port, params)
+	if err != nil {
+		return nil, err
+	}
+	req = req.WithContext(ctx)
+	if err := c.applyEditors(ctx, req, reqEditors); err != nil {
+		return nil, err
+	}
+	return c.Client.Do(req)
+}
+
+func (c *Client) PostSandboxesSandboxIDPause(ctx context.Context, sandboxID SandboxID, reqEditors ...RequestEditorFn) (*http.Response, error) {
+	req, err := NewPostSandboxesSandboxIDPauseRequest(c.Server, sandboxID)
+	if err != nil {
+		return nil, err
+	}
+	req = req.WithContext(ctx)
+	if err := c.applyEditors(ctx, req, reqEditors); err != nil {
+		return nil, err
+	}
+	return c.Client.Do(req)
+}
+
+func (c *Client) PostSandboxesSandboxIDRenewExpirationWithBody(ctx context.Context, sandboxID SandboxID, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*http.Response, error) {
+	req, err := NewPostSandboxesSandboxIDRenewExpirationRequestWithBody(c.Server, sandboxID, contentType, body)
+	if err != nil {
+		return nil, err
+	}
+	req = req.WithContext(ctx)
+	if err := c.applyEditors(ctx, req, reqEditors); err != nil {
+		return nil, err
+	}
+	return c.Client.Do(req)
+}
+
+func (c *Client) PostSandboxesSandboxIDRenewExpiration(ctx context.Context, sandboxID SandboxID, body PostSandboxesSandboxIDRenewExpirationJSONRequestBody, reqEditors ...RequestEditorFn) (*http.Response, error) {
+	req, err := NewPostSandboxesSandboxIDRenewExpirationRequest(c.Server, sandboxID, body)
+	if err != nil {
+		return nil, err
+	}
+	req = req.WithContext(ctx)
+	if err := c.applyEditors(ctx, req, reqEditors); err != nil {
+		return nil, err
+	}
+	return c.Client.Do(req)
+}
+
+func (c *Client) PostSandboxesSandboxIDResume(ctx context.Context, sandboxID SandboxID, reqEditors ...RequestEditorFn) (*http.Response, error) {
+	req, err := NewPostSandboxesSandboxIDResumeRequest(c.Server, sandboxID)
+	if err != nil {
+		return nil, err
+	}
+	req = req.WithContext(ctx)
+	if err := c.applyEditors(ctx, req, reqEditors); err != nil {
+		return nil, err
+	}
+	return c.Client.Do(req)
+}
+
+// NewGetSandboxesRequest generates requests for GetSandboxes
+func NewGetSandboxesRequest(server string, params *GetSandboxesParams) (*http.Request, error) {
+	var err error
+
+	serverURL, err := url.Parse(server)
+	if err != nil {
+		return nil, err
+	}
+
+	operationPath := fmt.Sprintf("/sandboxes")
+	if operationPath[0] == '/' {
+		operationPath = "." + operationPath
+	}
+
+	queryURL, err := serverURL.Parse(operationPath)
+	if err != nil {
+		return nil, err
+	}
+
+	if params != nil {
+		queryValues := queryURL.Query()
+
+		if params.State != nil {
+
+			if queryFrag, err := runtime.StyleParamWithOptions("form", true, "state", *params.State, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "array", Format: ""}); err != nil {
+				return nil, err
+			} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+				return nil, err
+			} else {
+				for k, v := range parsed {
+					for _, v2 := range v {
+						queryValues.Add(k, v2)
+					}
+				}
+			}
+
+		}
+
+		if params.Metadata != nil {
+
+			if queryFrag, err := runtime.StyleParamWithOptions("form", true, "metadata", *params.Metadata, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "string", Format: ""}); err != nil {
+				return nil, err
+			} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+				return nil, err
+			} else {
+				for k, v := range parsed {
+					for _, v2 := range v {
+						queryValues.Add(k, v2)
+					}
+				}
+			}
+
+		}
+
+		if params.Page != nil {
+
+			if queryFrag, err := runtime.StyleParamWithOptions("form", true, "page", *params.Page, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "integer", Format: ""}); err != nil {
+				return nil, err
+			} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+				return nil, err
+			} else {
+				for k, v := range parsed {
+					for _, v2 := range v {
+						queryValues.Add(k, v2)
+					}
+				}
+			}
+
+		}
+
+		if params.PageSize != nil {
+
+			if queryFrag, err := runtime.StyleParamWithOptions("form", true, "pageSize", *params.PageSize, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "integer", Format: ""}); err != nil {
+				return nil, err
+			} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+				return nil, err
+			} else {
+				for k, v := range parsed {
+					for _, v2 := range v {
+						queryValues.Add(k, v2)
+					}
+				}
+			}
+
+		}
+
+		queryURL.RawQuery = queryValues.Encode()
+	}
+
+	req, err := http.NewRequest("GET", queryURL.String(), nil)
+	if err != nil {
+		return nil, err
+	}
+
+	return req, nil
+}
+
+// NewPostSandboxesRequest calls the generic PostSandboxes builder with application/json body
+func NewPostSandboxesRequest(server string, body PostSandboxesJSONRequestBody) (*http.Request, error) {
+	var bodyReader io.Reader
+	buf, err := json.Marshal(body)
+	if err != nil {
+		return nil, err
+	}
+	bodyReader = bytes.NewReader(buf)
+	return NewPostSandboxesRequestWithBody(server, "application/json", bodyReader)
+}
+
+// NewPostSandboxesRequestWithBody generates requests for PostSandboxes with any type of body
+func NewPostSandboxesRequestWithBody(server string, contentType string, body io.Reader) (*http.Request, error) {
+	var err error
+
+	serverURL, err := url.Parse(server)
+	if err != nil {
+		return nil, err
+	}
+
+	operationPath := fmt.Sprintf("/sandboxes")
+	if operationPath[0] == '/' {
+		operationPath = "." + operationPath
+	}
+
+	queryURL, err := serverURL.Parse(operationPath)
+	if err != nil {
+		return nil, err
+	}
+
+	req, err := http.NewRequest("POST", queryURL.String(), body)
+	if err != nil {
+		return nil, err
+	}
+
+	req.Header.Add("Content-Type", contentType)
+
+	return req, nil
+}
+
+// NewDeleteSandboxesSandboxIDRequest generates requests for DeleteSandboxesSandboxID
+func NewDeleteSandboxesSandboxIDRequest(server string, sandboxID SandboxID) (*http.Request, error) {
+	var err error
+
+	var pathParam0 string
+
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "sandboxId", sandboxID, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
+	if err != nil {
+		return nil, err
+	}
+
+	serverURL, err := url.Parse(server)
+	if err != nil {
+		return nil, err
+	}
+
+	operationPath := fmt.Sprintf("/sandboxes/%s", pathParam0)
+	if operationPath[0] == '/' {
+		operationPath = "." + operationPath
+	}
+
+	queryURL, err := serverURL.Parse(operationPath)
+	if err != nil {
+		return nil, err
+	}
+
+	req, err := http.NewRequest("DELETE", queryURL.String(), nil)
+	if err != nil {
+		return nil, err
+	}
+
+	return req, nil
+}
+
+// NewGetSandboxesSandboxIDRequest generates requests for GetSandboxesSandboxID
+func NewGetSandboxesSandboxIDRequest(server string, sandboxID SandboxID) (*http.Request, error) {
+	var err error
+
+	var pathParam0 string
+
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "sandboxId", sandboxID, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
+	if err != nil {
+		return nil, err
+	}
+
+	serverURL, err := url.Parse(server)
+	if err != nil {
+		return nil, err
+	}
+
+	operationPath := fmt.Sprintf("/sandboxes/%s", pathParam0)
+	if operationPath[0] == '/' {
+		operationPath = "." + operationPath
+	}
+
+	queryURL, err := serverURL.Parse(operationPath)
+	if err != nil {
+		return nil, err
+	}
+
+	req, err := http.NewRequest("GET", queryURL.String(), nil)
+	if err != nil {
+		return nil, err
+	}
+
+	return req, nil
+}
+
+// NewGetSandboxesSandboxIDEndpointsPortRequest generates requests for GetSandboxesSandboxIDEndpointsPort
+func NewGetSandboxesSandboxIDEndpointsPortRequest(server string, sandboxID SandboxID, port int, params *GetSandboxesSandboxIDEndpointsPortParams) (*http.Request, error) {
+	var err error
+
+	var pathParam0 string
+
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "sandboxId", sandboxID, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
+	if err != nil {
+		return nil, err
+	}
+
+	var pathParam1 string
+
+	pathParam1, err = runtime.StyleParamWithOptions("simple", false, "port", port, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "integer", Format: ""})
+	if err != nil {
+		return nil, err
+	}
+
+	serverURL, err := url.Parse(server)
+	if err != nil {
+		return nil, err
+	}
+
+	operationPath := fmt.Sprintf("/sandboxes/%s/endpoints/%s", pathParam0, pathParam1)
+	if operationPath[0] == '/' {
+		operationPath = "." + operationPath
+	}
+
+	queryURL, err := serverURL.Parse(operationPath)
+	if err != nil {
+		return nil, err
+	}
+
+	if params != nil {
+		queryValues := queryURL.Query()
+
+		if params.UseServerProxy != nil {
+
+			if queryFrag, err := runtime.StyleParamWithOptions("form", true, "use_server_proxy", *params.UseServerProxy, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "boolean", Format: ""}); err != nil {
+				return nil, err
+			} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+				return nil, err
+			} else {
+				for k, v := range parsed {
+					for _, v2 := range v {
+						queryValues.Add(k, v2)
+					}
+				}
+			}
+
+		}
+
+		queryURL.RawQuery = queryValues.Encode()
+	}
+
+	req, err := http.NewRequest("GET", queryURL.String(), nil)
+	if err != nil {
+		return nil, err
+	}
+
+	return req, nil
+}
+
+// NewPostSandboxesSandboxIDPauseRequest generates requests for PostSandboxesSandboxIDPause
+func NewPostSandboxesSandboxIDPauseRequest(server string, sandboxID SandboxID) (*http.Request, error) {
+	var err error
+
+	var pathParam0 string
+
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "sandboxId", sandboxID, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
+	if err != nil {
+		return nil, err
+	}
+
+	serverURL, err := url.Parse(server)
+	if err != nil {
+		return nil, err
+	}
+
+	operationPath := fmt.Sprintf("/sandboxes/%s/pause", pathParam0)
+	if operationPath[0] == '/' {
+		operationPath = "." + operationPath
+	}
+
+	queryURL, err := serverURL.Parse(operationPath)
+	if err != nil {
+		return nil, err
+	}
+
+	req, err := http.NewRequest("POST", queryURL.String(), nil)
+	if err != nil {
+		return nil, err
+	}
+
+	return req, nil
+}
+
+// NewPostSandboxesSandboxIDRenewExpirationRequest calls the generic PostSandboxesSandboxIDRenewExpiration builder with application/json body
+func NewPostSandboxesSandboxIDRenewExpirationRequest(server string, sandboxID SandboxID, body PostSandboxesSandboxIDRenewExpirationJSONRequestBody) (*http.Request, error) {
+	var bodyReader io.Reader
+	buf, err := json.Marshal(body)
+	if err != nil {
+		return nil, err
+	}
+	bodyReader = bytes.NewReader(buf)
+	return NewPostSandboxesSandboxIDRenewExpirationRequestWithBody(server, sandboxID, "application/json", bodyReader)
+}
+
+// NewPostSandboxesSandboxIDRenewExpirationRequestWithBody generates requests for PostSandboxesSandboxIDRenewExpiration with any type of body
+func NewPostSandboxesSandboxIDRenewExpirationRequestWithBody(server string, sandboxID SandboxID, contentType string, body io.Reader) (*http.Request, error) {
+	var err error
+
+	var pathParam0 string
+
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "sandboxId", sandboxID, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
+	if err != nil {
+		return nil, err
+	}
+
+	serverURL, err := url.Parse(server)
+	if err != nil {
+		return nil, err
+	}
+
+	operationPath := fmt.Sprintf("/sandboxes/%s/renew-expiration", pathParam0)
+	if operationPath[0] == '/' {
+		operationPath = "." + operationPath
+	}
+
+	queryURL, err := serverURL.Parse(operationPath)
+	if err != nil {
+		return nil, err
+	}
+
+	req, err := http.NewRequest("POST", queryURL.String(), body)
+	if err != nil {
+		return nil, err
+	}
+
+	req.Header.Add("Content-Type", contentType)
+
+	return req, nil
+}
+
+// NewPostSandboxesSandboxIDResumeRequest generates requests for PostSandboxesSandboxIDResume
+func NewPostSandboxesSandboxIDResumeRequest(server string, sandboxID SandboxID) (*http.Request, error) {
+	var err error
+
+	var pathParam0 string
+
+	pathParam0, err = runtime.StyleParamWithOptions("simple", false, "sandboxId", sandboxID, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""})
+	if err != nil {
+		return nil, err
+	}
+
+	serverURL, err := url.Parse(server)
+	if err != nil {
+		return nil, err
+	}
+
+	operationPath := fmt.Sprintf("/sandboxes/%s/resume", pathParam0)
+	if operationPath[0] == '/' {
+		operationPath = "." + operationPath
+	}
+
+	queryURL, err := serverURL.Parse(operationPath)
+	if err != nil {
+		return nil, err
+	}
+
+	req, err := http.NewRequest("POST", queryURL.String(), nil)
+	if err != nil {
+		return nil, err
+	}
+
+	return req, nil
+}
+
+func (c *Client) applyEditors(ctx context.Context, req *http.Request, additionalEditors []RequestEditorFn) error {
+	for _, r := range c.RequestEditors {
+		if err := r(ctx, req); err != nil {
+			return err
+		}
+	}
+	for _, r := range additionalEditors {
+		if err := r(ctx, req); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// ClientWithResponses builds on ClientInterface to offer response payloads
+type ClientWithResponses struct {
+	ClientInterface
+}
+
+// NewClientWithResponses creates a new ClientWithResponses, which wraps
+// Client with return type handling
+func NewClientWithResponses(server string, opts ...ClientOption) (*ClientWithResponses, error) {
+	client, err := NewClient(server, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return &ClientWithResponses{client}, nil
+}
+
+// WithBaseURL overrides the baseURL.
+func WithBaseURL(baseURL string) ClientOption {
+	return func(c *Client) error {
+		newBaseURL, err := url.Parse(baseURL)
+		if err != nil {
+			return err
+		}
+		c.Server = newBaseURL.String()
+		return nil
+	}
+}
+
+// ClientWithResponsesInterface is the interface specification for the client with responses above.
+type ClientWithResponsesInterface interface {
+	// GetSandboxesWithResponse request
+	GetSandboxesWithResponse(ctx context.Context, params *GetSandboxesParams, reqEditors ...RequestEditorFn) (*GetSandboxesResponse, error)
+
+	// PostSandboxesWithBodyWithResponse request with any body
+	PostSandboxesWithBodyWithResponse(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*PostSandboxesResponse, error)
+
+	PostSandboxesWithResponse(ctx context.Context, body PostSandboxesJSONRequestBody, reqEditors ...RequestEditorFn) (*PostSandboxesResponse, error)
+
+	// DeleteSandboxesSandboxIDWithResponse request
+	DeleteSandboxesSandboxIDWithResponse(ctx context.Context, sandboxID SandboxID, reqEditors ...RequestEditorFn) (*DeleteSandboxesSandboxIDResponse, error)
+
+	// GetSandboxesSandboxIDWithResponse request
+	GetSandboxesSandboxIDWithResponse(ctx context.Context, sandboxID SandboxID, reqEditors ...RequestEditorFn) (*GetSandboxesSandboxIDResponse, error)
+
+	// GetSandboxesSandboxIDEndpointsPortWithResponse request
+	GetSandboxesSandboxIDEndpointsPortWithResponse(ctx context.Context, sandboxID SandboxID, port int, params *GetSandboxesSandboxIDEndpointsPortParams, reqEditors ...RequestEditorFn) (*GetSandboxesSandboxIDEndpointsPortResponse, error)
+
+	// PostSandboxesSandboxIDPauseWithResponse request
+	PostSandboxesSandboxIDPauseWithResponse(ctx context.Context, sandboxID SandboxID, reqEditors ...RequestEditorFn) (*PostSandboxesSandboxIDPauseResponse, error)
+
+	// PostSandboxesSandboxIDRenewExpirationWithBodyWithResponse request with any body
+	PostSandboxesSandboxIDRenewExpirationWithBodyWithResponse(ctx context.Context, sandboxID SandboxID, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*PostSandboxesSandboxIDRenewExpirationResponse, error)
+
+	PostSandboxesSandboxIDRenewExpirationWithResponse(ctx context.Context, sandboxID SandboxID, body PostSandboxesSandboxIDRenewExpirationJSONRequestBody, reqEditors ...RequestEditorFn) (*PostSandboxesSandboxIDRenewExpirationResponse, error)
+
+	// PostSandboxesSandboxIDResumeWithResponse request
+	PostSandboxesSandboxIDResumeWithResponse(ctx context.Context, sandboxID SandboxID, reqEditors ...RequestEditorFn) (*PostSandboxesSandboxIDResumeResponse, error)
+}
+
+type GetSandboxesResponse struct {
+	Body         []byte
+	HTTPResponse *http.Response
+	JSON200      *ListSandboxesResponse
+	JSON400      *BadRequest
+	JSON401      *Unauthorized
+	JSON500      *InternalServerError
+}
+
+// Status returns HTTPResponse.Status
+func (r GetSandboxesResponse) Status() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Status
+	}
+	return http.StatusText(0)
+}
+
+// StatusCode returns HTTPResponse.StatusCode
+func (r GetSandboxesResponse) StatusCode() int {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.StatusCode
+	}
+	return 0
+}
+
+type PostSandboxesResponse struct {
+	Body         []byte
+	HTTPResponse *http.Response
+	JSON202      *CreateSandboxResponse
+	JSON400      *BadRequest
+	JSON401      *Unauthorized
+	JSON409      *Conflict
+	JSON500      *InternalServerError
+}
+
+// Status returns HTTPResponse.Status
+func (r PostSandboxesResponse) Status() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Status
+	}
+	return http.StatusText(0)
+}
+
+// StatusCode returns HTTPResponse.StatusCode
+func (r PostSandboxesResponse) StatusCode() int {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.StatusCode
+	}
+	return 0
+}
+
+type DeleteSandboxesSandboxIDResponse struct {
+	Body         []byte
+	HTTPResponse *http.Response
+	JSON401      *Unauthorized
+	JSON403      *Forbidden
+	JSON404      *NotFound
+	JSON409      *Conflict
+	JSON500      *InternalServerError
+}
+
+// Status returns HTTPResponse.Status
+func (r DeleteSandboxesSandboxIDResponse) Status() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Status
+	}
+	return http.StatusText(0)
+}
+
+// StatusCode returns HTTPResponse.StatusCode
+func (r DeleteSandboxesSandboxIDResponse) StatusCode() int {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.StatusCode
+	}
+	return 0
+}
+
+type GetSandboxesSandboxIDResponse struct {
+	Body         []byte
+	HTTPResponse *http.Response
+	JSON200      *Sandbox
+	JSON401      *Unauthorized
+	JSON403      *Forbidden
+	JSON404      *NotFound
+	JSON500      *InternalServerError
+}
+
+// Status returns HTTPResponse.Status
+func (r GetSandboxesSandboxIDResponse) Status() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Status
+	}
+	return http.StatusText(0)
+}
+
+// StatusCode returns HTTPResponse.StatusCode
+func (r GetSandboxesSandboxIDResponse) StatusCode() int {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.StatusCode
+	}
+	return 0
+}
+
+type GetSandboxesSandboxIDEndpointsPortResponse struct {
+	Body         []byte
+	HTTPResponse *http.Response
+	JSON200      *Endpoint
+	JSON401      *Unauthorized
+	JSON403      *Forbidden
+	JSON404      *NotFound
+	JSON500      *InternalServerError
+}
+
+// Status returns HTTPResponse.Status
+func (r GetSandboxesSandboxIDEndpointsPortResponse) Status() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Status
+	}
+	return http.StatusText(0)
+}
+
+// StatusCode returns HTTPResponse.StatusCode
+func (r GetSandboxesSandboxIDEndpointsPortResponse) StatusCode() int {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.StatusCode
+	}
+	return 0
+}
+
+type PostSandboxesSandboxIDPauseResponse struct {
+	Body         []byte
+	HTTPResponse *http.Response
+	JSON401      *Unauthorized
+	JSON403      *Forbidden
+	JSON404      *NotFound
+	JSON409      *Conflict
+	JSON500      *InternalServerError
+}
+
+// Status returns HTTPResponse.Status
+func (r PostSandboxesSandboxIDPauseResponse) Status() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Status
+	}
+	return http.StatusText(0)
+}
+
+// StatusCode returns HTTPResponse.StatusCode
+func (r PostSandboxesSandboxIDPauseResponse) StatusCode() int {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.StatusCode
+	}
+	return 0
+}
+
+type PostSandboxesSandboxIDRenewExpirationResponse struct {
+	Body         []byte
+	HTTPResponse *http.Response
+	JSON200      *RenewSandboxExpirationResponse
+	JSON400      *BadRequest
+	JSON401      *Unauthorized
+	JSON403      *Forbidden
+	JSON404      *NotFound
+	JSON409      *Conflict
+	JSON500      *InternalServerError
+}
+
+// Status returns HTTPResponse.Status
+func (r PostSandboxesSandboxIDRenewExpirationResponse) Status() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Status
+	}
+	return http.StatusText(0)
+}
+
+// StatusCode returns HTTPResponse.StatusCode
+func (r PostSandboxesSandboxIDRenewExpirationResponse) StatusCode() int {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.StatusCode
+	}
+	return 0
+}
+
+type PostSandboxesSandboxIDResumeResponse struct {
+	Body         []byte
+	HTTPResponse *http.Response
+	JSON401      *Unauthorized
+	JSON403      *Forbidden
+	JSON404      *NotFound
+	JSON409      *Conflict
+	JSON500      *InternalServerError
+}
+
+// Status returns HTTPResponse.Status
+func (r PostSandboxesSandboxIDResumeResponse) Status() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Status
+	}
+	return http.StatusText(0)
+}
+
+// StatusCode returns HTTPResponse.StatusCode
+func (r PostSandboxesSandboxIDResumeResponse) StatusCode() int {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.StatusCode
+	}
+	return 0
+}
+
+// GetSandboxesWithResponse request returning *GetSandboxesResponse
+func (c *ClientWithResponses) GetSandboxesWithResponse(ctx context.Context, params *GetSandboxesParams, reqEditors ...RequestEditorFn) (*GetSandboxesResponse, error) {
+	rsp, err := c.GetSandboxes(ctx, params, reqEditors...)
+	if err != nil {
+		return nil, err
+	}
+	return ParseGetSandboxesResponse(rsp)
+}
+
+// PostSandboxesWithBodyWithResponse request with arbitrary body returning *PostSandboxesResponse
+func (c *ClientWithResponses) PostSandboxesWithBodyWithResponse(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*PostSandboxesResponse, error) {
+	rsp, err := c.PostSandboxesWithBody(ctx, contentType, body, reqEditors...)
+	if err != nil {
+		return nil, err
+	}
+	return ParsePostSandboxesResponse(rsp)
+}
+
+func (c *ClientWithResponses) PostSandboxesWithResponse(ctx context.Context, body PostSandboxesJSONRequestBody, reqEditors ...RequestEditorFn) (*PostSandboxesResponse, error) {
+	rsp, err := c.PostSandboxes(ctx, body, reqEditors...)
+	if err != nil {
+		return nil, err
+	}
+	return ParsePostSandboxesResponse(rsp)
+}
+
+// DeleteSandboxesSandboxIDWithResponse request returning *DeleteSandboxesSandboxIDResponse
+func (c *ClientWithResponses) DeleteSandboxesSandboxIDWithResponse(ctx context.Context, sandboxID SandboxID, reqEditors ...RequestEditorFn) (*DeleteSandboxesSandboxIDResponse, error) {
+	rsp, err := c.DeleteSandboxesSandboxID(ctx, sandboxID, reqEditors...)
+	if err != nil {
+		return nil, err
+	}
+	return ParseDeleteSandboxesSandboxIDResponse(rsp)
+}
+
+// GetSandboxesSandboxIDWithResponse request returning *GetSandboxesSandboxIDResponse
+func (c *ClientWithResponses) GetSandboxesSandboxIDWithResponse(ctx context.Context, sandboxID SandboxID, reqEditors ...RequestEditorFn) (*GetSandboxesSandboxIDResponse, error) {
+	rsp, err := c.GetSandboxesSandboxID(ctx, sandboxID, reqEditors...)
+	if err != nil {
+		return nil, err
+	}
+	return ParseGetSandboxesSandboxIDResponse(rsp)
+}
+
+// GetSandboxesSandboxIDEndpointsPortWithResponse request returning *GetSandboxesSandboxIDEndpointsPortResponse
+func (c *ClientWithResponses) GetSandboxesSandboxIDEndpointsPortWithResponse(ctx context.Context, sandboxID SandboxID, port int, params *GetSandboxesSandboxIDEndpointsPortParams, reqEditors ...RequestEditorFn) (*GetSandboxesSandboxIDEndpointsPortResponse, error) {
+	rsp, err := c.GetSandboxesSandboxIDEndpointsPort(ctx, sandboxID, port, params, reqEditors...)
+	if err != nil {
+		return nil, err
+	}
+	return ParseGetSandboxesSandboxIDEndpointsPortResponse(rsp)
+}
+
+// PostSandboxesSandboxIDPauseWithResponse request returning *PostSandboxesSandboxIDPauseResponse
+func (c *ClientWithResponses) PostSandboxesSandboxIDPauseWithResponse(ctx context.Context, sandboxID SandboxID, reqEditors ...RequestEditorFn) (*PostSandboxesSandboxIDPauseResponse, error) {
+	rsp, err := c.PostSandboxesSandboxIDPause(ctx, sandboxID, reqEditors...)
+	if err != nil {
+		return nil, err
+	}
+	return ParsePostSandboxesSandboxIDPauseResponse(rsp)
+}
+
+// PostSandboxesSandboxIDRenewExpirationWithBodyWithResponse request with arbitrary body returning *PostSandboxesSandboxIDRenewExpirationResponse
+func (c *ClientWithResponses) PostSandboxesSandboxIDRenewExpirationWithBodyWithResponse(ctx context.Context, sandboxID SandboxID, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*PostSandboxesSandboxIDRenewExpirationResponse, error) {
+	rsp, err := c.PostSandboxesSandboxIDRenewExpirationWithBody(ctx, sandboxID, contentType, body, reqEditors...)
+	if err != nil {
+		return nil, err
+	}
+	return ParsePostSandboxesSandboxIDRenewExpirationResponse(rsp)
+}
+
+func (c *ClientWithResponses) PostSandboxesSandboxIDRenewExpirationWithResponse(ctx context.Context, sandboxID SandboxID, body PostSandboxesSandboxIDRenewExpirationJSONRequestBody, reqEditors ...RequestEditorFn) (*PostSandboxesSandboxIDRenewExpirationResponse, error) {
+	rsp, err := c.PostSandboxesSandboxIDRenewExpiration(ctx, sandboxID, body, reqEditors...)
+	if err != nil {
+		return nil, err
+	}
+	return ParsePostSandboxesSandboxIDRenewExpirationResponse(rsp)
+}
+
+// PostSandboxesSandboxIDResumeWithResponse request returning *PostSandboxesSandboxIDResumeResponse
+func (c *ClientWithResponses) PostSandboxesSandboxIDResumeWithResponse(ctx context.Context, sandboxID SandboxID, reqEditors ...RequestEditorFn) (*PostSandboxesSandboxIDResumeResponse, error) {
+	rsp, err := c.PostSandboxesSandboxIDResume(ctx, sandboxID, reqEditors...)
+	if err != nil {
+		return nil, err
+	}
+	return ParsePostSandboxesSandboxIDResumeResponse(rsp)
+}
+
+// ParseGetSandboxesResponse parses an HTTP response from a GetSandboxesWithResponse call
+func ParseGetSandboxesResponse(rsp *http.Response) (*GetSandboxesResponse, error) {
+	bodyBytes, err := io.ReadAll(rsp.Body)
+	defer func() { _ = rsp.Body.Close() }()
+	if err != nil {
+		return nil, err
+	}
+
+	response := &GetSandboxesResponse{
+		Body:         bodyBytes,
+		HTTPResponse: rsp,
+	}
+
+	switch {
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 200:
+		var dest ListSandboxesResponse
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON200 = &dest
+
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 400:
+		var dest BadRequest
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON400 = &dest
+
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 401:
+		var dest Unauthorized
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON401 = &dest
+
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 500:
+		var dest InternalServerError
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON500 = &dest
+
+	}
+
+	return response, nil
+}
+
+// ParsePostSandboxesResponse parses an HTTP response from a PostSandboxesWithResponse call
+func ParsePostSandboxesResponse(rsp *http.Response) (*PostSandboxesResponse, error) {
+	bodyBytes, err := io.ReadAll(rsp.Body)
+	defer func() { _ = rsp.Body.Close() }()
+	if err != nil {
+		return nil, err
+	}
+
+	response := &PostSandboxesResponse{
+		Body:         bodyBytes,
+		HTTPResponse: rsp,
+	}
+
+	switch {
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 202:
+		var dest CreateSandboxResponse
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON202 = &dest
+
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 400:
+		var dest BadRequest
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON400 = &dest
+
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 401:
+		var dest Unauthorized
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON401 = &dest
+
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 409:
+		var dest Conflict
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON409 = &dest
+
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 500:
+		var dest InternalServerError
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON500 = &dest
+
+	}
+
+	return response, nil
+}
+
+// ParseDeleteSandboxesSandboxIDResponse parses an HTTP response from a DeleteSandboxesSandboxIDWithResponse call
+func ParseDeleteSandboxesSandboxIDResponse(rsp *http.Response) (*DeleteSandboxesSandboxIDResponse, error) {
+	bodyBytes, err := io.ReadAll(rsp.Body)
+	defer func() { _ = rsp.Body.Close() }()
+	if err != nil {
+		return nil, err
+	}
+
+	response := &DeleteSandboxesSandboxIDResponse{
+		Body:         bodyBytes,
+		HTTPResponse: rsp,
+	}
+
+	switch {
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 401:
+		var dest Unauthorized
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON401 = &dest
+
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 403:
+		var dest Forbidden
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON403 = &dest
+
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 404:
+		var dest NotFound
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON404 = &dest
+
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 409:
+		var dest Conflict
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON409 = &dest
+
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 500:
+		var dest InternalServerError
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON500 = &dest
+
+	}
+
+	return response, nil
+}
+
+// ParseGetSandboxesSandboxIDResponse parses an HTTP response from a GetSandboxesSandboxIDWithResponse call
+func ParseGetSandboxesSandboxIDResponse(rsp *http.Response) (*GetSandboxesSandboxIDResponse, error) {
+	bodyBytes, err := io.ReadAll(rsp.Body)
+	defer func() { _ = rsp.Body.Close() }()
+	if err != nil {
+		return nil, err
+	}
+
+	response := &GetSandboxesSandboxIDResponse{
+		Body:         bodyBytes,
+		HTTPResponse: rsp,
+	}
+
+	switch {
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 200:
+		var dest Sandbox
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON200 = &dest
+
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 401:
+		var dest Unauthorized
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON401 = &dest
+
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 403:
+		var dest Forbidden
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON403 = &dest
+
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 404:
+		var dest NotFound
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON404 = &dest
+
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 500:
+		var dest InternalServerError
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON500 = &dest
+
+	}
+
+	return response, nil
+}
+
+// ParseGetSandboxesSandboxIDEndpointsPortResponse parses an HTTP response from a GetSandboxesSandboxIDEndpointsPortWithResponse call
+func ParseGetSandboxesSandboxIDEndpointsPortResponse(rsp *http.Response) (*GetSandboxesSandboxIDEndpointsPortResponse, error) {
+	bodyBytes, err := io.ReadAll(rsp.Body)
+	defer func() { _ = rsp.Body.Close() }()
+	if err != nil {
+		return nil, err
+	}
+
+	response := &GetSandboxesSandboxIDEndpointsPortResponse{
+		Body:         bodyBytes,
+		HTTPResponse: rsp,
+	}
+
+	switch {
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 200:
+		var dest Endpoint
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON200 = &dest
+
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 401:
+		var dest Unauthorized
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON401 = &dest
+
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 403:
+		var dest Forbidden
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON403 = &dest
+
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 404:
+		var dest NotFound
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON404 = &dest
+
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 500:
+		var dest InternalServerError
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON500 = &dest
+
+	}
+
+	return response, nil
+}
+
+// ParsePostSandboxesSandboxIDPauseResponse parses an HTTP response from a PostSandboxesSandboxIDPauseWithResponse call
+func ParsePostSandboxesSandboxIDPauseResponse(rsp *http.Response) (*PostSandboxesSandboxIDPauseResponse, error) {
+	bodyBytes, err := io.ReadAll(rsp.Body)
+	defer func() { _ = rsp.Body.Close() }()
+	if err != nil {
+		return nil, err
+	}
+
+	response := &PostSandboxesSandboxIDPauseResponse{
+		Body:         bodyBytes,
+		HTTPResponse: rsp,
+	}
+
+	switch {
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 401:
+		var dest Unauthorized
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON401 = &dest
+
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 403:
+		var dest Forbidden
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON403 = &dest
+
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 404:
+		var dest NotFound
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON404 = &dest
+
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 409:
+		var dest Conflict
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON409 = &dest
+
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 500:
+		var dest InternalServerError
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON500 = &dest
+
+	}
+
+	return response, nil
+}
+
+// ParsePostSandboxesSandboxIDRenewExpirationResponse parses an HTTP response from a PostSandboxesSandboxIDRenewExpirationWithResponse call
+func ParsePostSandboxesSandboxIDRenewExpirationResponse(rsp *http.Response) (*PostSandboxesSandboxIDRenewExpirationResponse, error) {
+	bodyBytes, err := io.ReadAll(rsp.Body)
+	defer func() { _ = rsp.Body.Close() }()
+	if err != nil {
+		return nil, err
+	}
+
+	response := &PostSandboxesSandboxIDRenewExpirationResponse{
+		Body:         bodyBytes,
+		HTTPResponse: rsp,
+	}
+
+	switch {
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 200:
+		var dest RenewSandboxExpirationResponse
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON200 = &dest
+
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 400:
+		var dest BadRequest
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON400 = &dest
+
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 401:
+		var dest Unauthorized
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON401 = &dest
+
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 403:
+		var dest Forbidden
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON403 = &dest
+
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 404:
+		var dest NotFound
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON404 = &dest
+
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 409:
+		var dest Conflict
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON409 = &dest
+
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 500:
+		var dest InternalServerError
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON500 = &dest
+
+	}
+
+	return response, nil
+}
+
+// ParsePostSandboxesSandboxIDResumeResponse parses an HTTP response from a PostSandboxesSandboxIDResumeWithResponse call
+func ParsePostSandboxesSandboxIDResumeResponse(rsp *http.Response) (*PostSandboxesSandboxIDResumeResponse, error) {
+	bodyBytes, err := io.ReadAll(rsp.Body)
+	defer func() { _ = rsp.Body.Close() }()
+	if err != nil {
+		return nil, err
+	}
+
+	response := &PostSandboxesSandboxIDResumeResponse{
+		Body:         bodyBytes,
+		HTTPResponse: rsp,
+	}
+
+	switch {
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 401:
+		var dest Unauthorized
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON401 = &dest
+
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 403:
+		var dest Forbidden
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON403 = &dest
+
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 404:
+		var dest NotFound
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON404 = &dest
+
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 409:
+		var dest Conflict
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON409 = &dest
+
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 500:
+		var dest InternalServerError
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON500 = &dest
+
+	}
+
+	return response, nil
+}
diff --git a/sdks/sandbox/go/opensandbox/api/lifecycle/generate.go b/sdks/sandbox/go/opensandbox/api/lifecycle/generate.go
new file mode 100644
index 00000000..50f7618b
--- /dev/null
+++ b/sdks/sandbox/go/opensandbox/api/lifecycle/generate.go
@@ -0,0 +1,3 @@
+package lifecycle
+
+//go:generate oapi-codegen --config cfg.yaml ../specs/sandbox-lifecycle.yml
diff --git a/sdks/sandbox/go/opensandbox/api/specs/egress-api.yaml b/sdks/sandbox/go/opensandbox/api/specs/egress-api.yaml
new file mode 100644
index 00000000..ce5a1574
--- /dev/null
+++ b/sdks/sandbox/go/opensandbox/api/specs/egress-api.yaml
@@ -0,0 +1,184 @@
+openapi: 3.0.3
+info:
+  title: OpenSandbox Egress API
+  version: 0.1.0
+  description: |
+    The OpenSandbox Egress API exposes the runtime policy interface served by the
+    egress sidecar inside a sandbox. Unlike the lifecycle API, these operations are
+    performed by connecting to a sandbox endpoint for the egress port and calling
+    the sidecar directly.
+
+    This API is intended for runtime inspection and mutation of outbound network
+    policy after sandbox creation. Initial egress policy configuration during sandbox
+    provisioning remains part of the Sandbox Lifecycle API create request.
+
+    ## Access Model
+
+    Clients typically access this API in two steps:
+
+    1. Use the Sandbox Lifecycle API to resolve the sandbox endpoint for the egress
+       service port.
+    2. Send requests directly to that endpoint's `/policy` route.
+
+    ## Authentication
+
+    The sidecar may optionally require the `OPENSANDBOX-EGRESS-AUTH` header. When
+    the sandbox endpoint resolver returns required headers, clients must forward
+    them on every egress API request.
+servers:
+  - url: http://localhost:18080
+    description: Local egress sidecar
+tags:
+  - name: Policy
+    description: Inspect and mutate sandbox egress policy at runtime
+paths:
+  /policy:
+    get:
+      tags: [Policy]
+      summary: Get current egress policy
+      description: |
+        Returns the currently enforced egress policy and the sidecar's derived
+        runtime mode metadata.
+      responses:
+        '200':
+          description: Current policy returned successfully.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/PolicyStatusResponse'
+              examples:
+                deny-with-allowlist:
+                  summary: Current deny-by-default policy
+                  value:
+                    status: ok
+                    mode: deny_all
+                    enforcementMode: dns
+                    policy:
+                      defaultAction: deny
+                      egress:
+                        - action: allow
+                          target: pypi.org
+        '401':
+          $ref: '#/components/responses/Unauthorized'
+        '500':
+          $ref: '#/components/responses/InternalServerError'
+    patch:
+      tags: [Policy]
+      summary: Patch egress rules
+      description: |
+        Merge incoming egress rules with the currently enforced policy.
+
+        This endpoint uses merge semantics:
+        - Existing rules remain unless overridden by incoming rules.
+        - Incoming rules are applied with higher priority than existing rules.
+        - If multiple incoming rules refer to the same `target`, the first one wins.
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: array
+              minItems: 1
+              items:
+                $ref: '#/components/schemas/NetworkRule'
+            examples:
+              duplicate-target-first-wins:
+                summary: First rule wins for duplicate target within the same patch payload
+                value:
+                  - action: allow
+                    target: example.com
+                  - action: deny
+                    target: example.com
+      responses:
+        '200':
+          description: Patch applied successfully.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/PolicyStatusResponse'
+              examples:
+                patched:
+                  summary: Patch applied
+                  value:
+                    status: ok
+                    mode: deny_all
+                    enforcementMode: dns
+        '400':
+          $ref: '#/components/responses/BadRequest'
+        '401':
+          $ref: '#/components/responses/Unauthorized'
+        '500':
+          $ref: '#/components/responses/InternalServerError'
+components:
+  responses:
+    BadRequest:
+      description: The request was invalid or malformed.
+      content:
+        text/plain:
+          schema:
+            type: string
+    Unauthorized:
+      description: Authentication failed for the egress sidecar.
+      content:
+        text/plain:
+          schema:
+            type: string
+    InternalServerError:
+      description: The sidecar failed to apply or fetch policy state.
+      content:
+        text/plain:
+          schema:
+            type: string
+  schemas:
+    PolicyStatusResponse:
+      type: object
+      properties:
+        status:
+          type: string
+          description: Operation status reported by the sidecar.
+          example: ok
+        mode:
+          type: string
+          description: Derived runtime mode for the current policy.
+          example: deny_all
+        enforcementMode:
+          type: string
+          description: Egress sidecar enforcement backend mode.
+          example: dns
+        reason:
+          type: string
+          description: Optional human-readable reason when the sidecar returns extra context.
+        policy:
+          $ref: '#/components/schemas/NetworkPolicy'
+      additionalProperties: false
+    NetworkPolicy:
+      type: object
+      description: |
+        Egress network policy matching the sidecar `/policy` request body.
+        If `defaultAction` is omitted, the sidecar defaults to "deny"; passing an empty
+        object or null results in allow-all behavior at startup.
+      properties:
+        defaultAction:
+          type: string
+          enum: [allow, deny]
+          description: Default action when no egress rule matches. Defaults to "deny".
+        egress:
+          type: array
+          description: List of egress rules evaluated in order.
+          items:
+            $ref: '#/components/schemas/NetworkRule'
+      additionalProperties: false
+    NetworkRule:
+      type: object
+      properties:
+        action:
+          type: string
+          enum: [allow, deny]
+          description: Whether to allow or deny matching targets.
+        target:
+          type: string
+          description: |
+            FQDN or wildcard domain (e.g., "example.com", "*.example.com").
+            IP/CIDR not yet supported in the egress MVP.
+      required: [action, target]
+      additionalProperties: false
diff --git a/sdks/sandbox/go/opensandbox/api/specs/execd-api.yaml b/sdks/sandbox/go/opensandbox/api/specs/execd-api.yaml
new file mode 100644
index 00000000..3eb72972
--- /dev/null
+++ b/sdks/sandbox/go/opensandbox/api/specs/execd-api.yaml
@@ -0,0 +1,1407 @@
+openapi: 3.0.3
+info:
+  title: OpenSandbox Execd API
+  version: 1.0.0
+  description: |
+    OpenSandbox Execd provides a comprehensive API for managing code execution, file operations,
+    and system monitoring within a sandboxed environment. The API supports multiple programming
+    languages, real-time streaming output via Server-Sent Events (SSE), and complete file system
+    management capabilities.
+
+    ## Key Features
+    - **Code Execution**: Execute code in Python, JavaScript, and other languages with stateful contexts
+    - **Command Execution**: Run shell commands with foreground/background modes
+    - **File Operations**: Complete CRUD operations for files and directories
+    - **Real-time Streaming**: SSE-based output streaming for code and command execution
+    - **System Monitoring**: CPU and memory metrics with real-time watching
+    - **Access Control**: Token-based authentication for all API endpoints
+
+  contact:
+    name: OpenSandbox Team
+    url: https://github.com/alibaba/OpenSandbox
+  license:
+    name: Apache 2.0
+    url: https://www.apache.org/licenses/LICENSE-2.0.html
+
+servers:
+  - url: http://localhost:44772
+    description: Local development server
+  - url: https://api.opensandbox.example.com
+    description: Production server
+
+security:
+  - AccessToken: []
+
+tags:
+  - name: Health
+    description: Server health check and status monitoring
+  - name: CodeInterpreting
+    description: Code execution and context management
+  - name: Command
+    description: Shell command execution and interruption
+  - name: Filesystem
+    description: File and directory operations
+  - name: Metric
+    description: System resource monitoring and metrics
+
+paths:
+  /ping:
+    get:
+      summary: Health check endpoint
+      description: |
+        Performs a simple health check to verify that the server is running and responsive.
+        Returns HTTP 200 OK status if the server is healthy. This endpoint is typically used
+        by load balancers, monitoring systems, and orchestration platforms (like Kubernetes)
+        to check service availability.
+      operationId: ping
+      tags:
+        - Health
+      responses:
+        "200":
+          description: Server is alive and healthy
+
+  /code/contexts:
+    get:
+      summary: List active code execution contexts
+      description: |
+        Lists all active/available code execution contexts.
+        If `language` is provided, only contexts under that language/runtime are returned.
+      operationId: listContexts
+      tags:
+        - CodeInterpreting
+      parameters:
+        - name: language
+          in: query
+          required: true
+          description: Filter contexts by execution runtime (python, bash, java, etc.)
+          schema:
+            type: string
+          example: python
+      responses:
+        "200":
+          description: Array of active contexts
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: "#/components/schemas/CodeContext"
+              examples:
+                python_only:
+                  summary: Context list filtered by language
+                  value:
+                    - id: session-abc123
+                      language: python
+                    - id: session-def456
+                      language: python
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+
+    delete:
+      summary: Delete all contexts under a language
+      description: |
+        Deletes all existing code execution contexts under the specified `language`/runtime.
+        This is a bulk operation intended for code-interpreter context cleanup.
+      operationId: deleteContextsByLanguage
+      tags:
+        - CodeInterpreting
+      parameters:
+        - name: language
+          in: query
+          required: true
+          description: Target execution runtime whose contexts should be deleted
+          schema:
+            type: string
+          example: python
+      responses:
+        "200":
+          description: Contexts deleted successfully
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+
+  /code/contexts/{context_id}:
+    get:
+      summary: Get a code execution context by id
+      description: |
+        Retrieves the details of an existing code execution context (session) by id.
+        Returns the context ID, language, and any associated metadata.
+      operationId: getContext
+      tags:
+        - CodeInterpreting
+      parameters:
+        - name: context_id
+          in: path
+          required: true
+          description: Session/context id to get
+          schema:
+            type: string
+          example: session-abc123
+      responses:
+        "200":
+          description: Context details retrieved successfully
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/CodeContext"
+        "404":
+          $ref: "#/components/responses/NotFound"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+    delete:
+      summary: Delete a code execution context by id
+      description: |
+        Deletes an existing code execution context (session) by id.
+        This should terminate the underlying context thread/process and release resources.
+      operationId: deleteContext
+      tags:
+        - CodeInterpreting
+      parameters:
+        - name: context_id
+          in: path
+          required: true
+          description: Session/context id to delete
+          schema:
+            type: string
+          example: session-abc123
+      responses:
+        "200":
+          description: Context deleted successfully
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "404":
+          $ref: "#/components/responses/NotFound"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+
+  /code/context:
+    post:
+      summary: Create code execution context
+      description: |
+        Creates a new code execution environment and returns a session ID that can be used
+        for subsequent code execution requests. The context maintains state across multiple
+        code executions within the same session.
+      operationId: createCodeContext
+      tags:
+        - CodeInterpreting
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/CodeContextRequest"
+            examples:
+              python:
+                summary: Create Python context
+                value:
+                  language: python
+              bash:
+                summary: Create Bash context
+                value:
+                  language: bash
+      responses:
+        "200":
+          description: Successfully created context with session ID
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/CodeContext"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+
+  /code:
+    post:
+      summary: Execute code in context
+      description: |
+        Executes code using Jupyter kernel in a specified execution context and streams
+        the output in real-time using SSE (Server-Sent Events). Supports multiple programming
+        languages (Python, JavaScript, etc.) and maintains execution state within the session.
+        Returns execution results, output streams, execution count, and any errors.
+      operationId: runCode
+      tags:
+        - CodeInterpreting
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/RunCodeRequest"
+            examples:
+              python:
+                summary: Execute Python code
+                value:
+                  context:
+                    id: session-123
+                    language: python
+                  code: |
+                    print("Hello, World!")
+                    result = 2 + 2
+                    result
+              stateless:
+                summary: Stateless execution
+                value:
+                  code: echo "Hello from shell"
+      responses:
+        "200":
+          description: Stream of code execution events
+          content:
+            text/event-stream:
+              schema:
+                $ref: "#/components/schemas/ServerStreamEvent"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+
+    delete:
+      summary: Interrupt code execution
+      description: |
+        Interrupts the currently running code execution in the specified context.
+        This sends a signal to terminate the execution process and releases associated resources.
+      operationId: interruptCode
+      tags:
+        - CodeInterpreting
+      parameters:
+        - name: id
+          in: query
+          required: true
+          description: Session ID of the execution context to interrupt
+          schema:
+            type: string
+          example: session-123
+      responses:
+        "200":
+          description: Code execution successfully interrupted
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+
+  /session:
+    post:
+      summary: Create bash session (create_session)
+      description: |
+        Creates a new bash session and returns a session ID for subsequent run_in_session requests.
+        The session maintains shell state (e.g. working directory, environment) across multiple
+        code executions. Request body is optional; an empty body uses default options (no cwd override).
+      operationId: createSession
+      tags:
+        - Command
+      requestBody:
+        required: false
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/CreateSessionRequest"
+            examples:
+              default:
+                summary: Default (empty body allowed)
+                value: {}
+              with_cwd:
+                summary: With working directory
+                value:
+                  cwd: /workspace
+      responses:
+        "200":
+          description: Session created successfully
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/SessionCreated"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+
+  /session/{sessionId}/run:
+    post:
+      summary: Run command in bash session (run_in_session)
+      description: |
+        Executes a shell command in an existing bash session and streams the output in real-time via SSE
+        (Server-Sent Events). The session must have been created by create_session. Supports
+        optional working directory override and timeout (milliseconds).
+      operationId: runInSession
+      tags:
+        - Command
+      parameters:
+        - name: sessionId
+          in: path
+          required: true
+          description: Session ID returned by create_session
+          schema:
+            type: string
+          example: session-abc123
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/RunInSessionRequest"
+            examples:
+              simple:
+                summary: Run shell command
+                value:
+                  command: echo "Hello from session"
+              with_options:
+                summary: With cwd and timeout
+                value:
+                  command: ls -la
+                  cwd: /workspace
+                  timeout: 30000
+      responses:
+        "200":
+          description: Stream of execution events
+          content:
+            text/event-stream:
+              schema:
+                $ref: "#/components/schemas/ServerStreamEvent"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+
+  /session/{sessionId}:
+    delete:
+      summary: Delete bash session (delete_session)
+      description: |
+        Deletes an existing bash session by ID. Terminates the underlying shell process
+        and releases resources. The session ID must have been returned by create_session.
+      operationId: deleteSession
+      tags:
+        - Command
+      parameters:
+        - name: sessionId
+          in: path
+          required: true
+          description: Session ID to delete
+          schema:
+            type: string
+          example: session-abc123
+      responses:
+        "200":
+          description: Session deleted successfully
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "404":
+          $ref: "#/components/responses/NotFound"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+
+  /command:
+    post:
+      summary: Execute shell command
+      description: |
+        Executes a shell command and streams the output in real-time using SSE (Server-Sent Events).
+        The command can run in foreground or background mode. The response includes stdout, stderr,
+        execution status, and completion events.
+        Optionally specify `timeout` (milliseconds) to enforce a maximum runtime; the server will
+        terminate the process when the timeout is reached. You can also pass `uid`/`gid` to run
+        with specific user/group IDs, and `envs` to inject environment variables.
+      operationId: runCommand
+      tags:
+        - Command
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/RunCommandRequest"
+            examples:
+              foreground:
+                summary: Foreground command
+                value:
+                  command: ls -la /workspace
+                  cwd: /workspace
+                  background: false
+                  timeout: 30000
+                  uid: 1000
+                  gid: 1000
+                  envs:
+                    PATH: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+                    PYTHONUNBUFFERED: "1"
+              background:
+                summary: Background command
+                value:
+                  command: python server.py
+                  cwd: /app
+                  background: true
+                  timeout: 120000
+                  uid: 1000
+                  envs:
+                    APP_ENV: production
+                    LOG_LEVEL: info
+      responses:
+        "200":
+          description: Stream of command execution events
+          content:
+            text/event-stream:
+              schema:
+                $ref: "#/components/schemas/ServerStreamEvent"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+
+    delete:
+      summary: Interrupt command execution
+      description: |
+        Interrupts the currently running command execution in the specified context.
+        This sends a signal to terminate the execution process and releases associated resources.
+      operationId: interruptCommand
+      tags:
+        - Command
+      parameters:
+        - name: id
+          in: query
+          required: true
+          description: Session ID of the execution context to interrupt
+          schema:
+            type: string
+          example: session-456
+      responses:
+        "200":
+          description: Command execution successfully interrupted
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+
+  /command/status/{id}:
+    get:
+      summary: Get command running status
+      description: |
+        Returns the current status of a command (foreground or background) by command ID.
+        Includes running flag, exit code, error (if any), and start/finish timestamps.
+      operationId: getCommandStatus
+      tags:
+        - Command
+      parameters:
+        - name: id
+          in: path
+          required: true
+          description: Command ID returned by RunCommand
+          schema:
+            type: string
+          example: cmd-abc123
+      responses:
+        "200":
+          description: Command status
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/CommandStatusResponse"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "404":
+          $ref: "#/components/responses/NotFound"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+
+  /command/{id}/logs:
+    get:
+      summary: Get background command stdout/stderr (non-streamed)
+      description: |
+        Returns stdout and stderr for a background (detached) command by command ID.
+        Foreground commands should be consumed via SSE; this endpoint is intended for
+        polling logs of background commands. Supports incremental reads similar to a file seek:
+        pass a starting line via query to fetch output after that line and receive the latest
+        tail cursor for the next poll. When no starting line is provided, the full logs are returned.
+        Response body is plain text so it can be rendered directly in browsers; the latest line index
+        is provided via response header `EXECD-COMMANDS-TAIL-CURSOR` for subsequent incremental requests.
+      operationId: getBackgroundCommandLogs
+      tags:
+        - Command
+      parameters:
+        - name: id
+          in: path
+          required: true
+          description: Command ID returned by RunCommand
+          schema:
+            type: string
+          example: cmd-abc123
+        - name: cursor
+          in: query
+          required: false
+          description: |
+            Optional 0-based line cursor (behaves like a file seek). When provided, only
+            stdout/stderr lines after this line are returned. The response includes the
+            latest line index (`cursor`) so the client can request incremental output
+            on subsequent calls. If omitted, the full log is returned.
+          schema:
+            type: integer
+            format: int64
+            minimum: 0
+          example: 120
+      responses:
+        "200":
+          description: Command output (plain text) and status metadata via headers
+          content:
+            text/plain:
+              schema:
+                type: string
+              example: |
+                line1
+                line2
+                warn: something on stderr
+          headers:
+            EXECD-COMMANDS-TAIL-CURSOR:
+              description: Highest available 0-based line index after applying the request cursor (use as the next cursor for incremental reads)
+              schema:
+                type: integer
+                format: int64
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "404":
+          $ref: "#/components/responses/NotFound"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+
+  /files/info:
+    get:
+      summary: Get file metadata
+      description: |
+        Retrieves detailed metadata for one or multiple files including permissions, owner,
+        group, size, and modification time. Returns a map of file paths to their corresponding
+        FileInfo objects.
+      operationId: getFilesInfo
+      tags:
+        - Filesystem
+      parameters:
+        - name: path
+          in: query
+          required: true
+          description: File path(s) to get info for (can be specified multiple times)
+          schema:
+            type: array
+            items:
+              type: string
+          style: form
+          explode: true
+          examples:
+            single:
+              summary: Single file
+              value: ["/workspace/file.txt"]
+            multiple:
+              summary: Multiple files
+              value: ["/workspace/file1.txt", "/workspace/file2.py"]
+      responses:
+        "200":
+          description: Map of file paths to FileInfo objects
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties:
+                  $ref: "#/components/schemas/FileInfo"
+        "404":
+          $ref: "#/components/responses/NotFound"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+
+  /files:
+    delete:
+      summary: Delete files
+      description: |
+        Deletes one or multiple files from the sandbox. Only removes files, not directories.
+        Use RemoveDirs for directory removal.
+      operationId: removeFiles
+      tags:
+        - Filesystem
+      parameters:
+        - name: path
+          in: query
+          required: true
+          description: File path(s) to delete (can be specified multiple times)
+          schema:
+            type: array
+            items:
+              type: string
+          style: form
+          explode: true
+          example: ["/workspace/temp.txt"]
+      responses:
+        "200":
+          description: Files deleted successfully
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+
+  /files/permissions:
+    post:
+      summary: Change file permissions
+      description: |
+        Changes permissions (mode), owner, and group for one or multiple files.
+        Accepts a map of file paths to permission settings including octal mode,
+        owner username, and group name.
+      operationId: chmodFiles
+      tags:
+        - Filesystem
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              additionalProperties:
+                $ref: "#/components/schemas/Permission"
+            example:
+              "/workspace/script.sh":
+                owner: admin
+                group: admin
+                mode: 755
+              "/workspace/config.json":
+                owner: admin
+                group: admin
+                mode: 755
+      responses:
+        "200":
+          description: Permissions changed successfully
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+
+  /files/mv:
+    post:
+      summary: Rename or move files
+      description: |
+        Renames or moves one or multiple files to new paths. Can be used for both
+        renaming within the same directory and moving to different directories.
+        Target directory must exist.
+      operationId: renameFiles
+      tags:
+        - Filesystem
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: array
+              items:
+                $ref: "#/components/schemas/RenameFileItem"
+            example:
+              - src: /workspace/old_name.txt
+                dest: /workspace/new_name.txt
+              - src: /workspace/file.py
+                dest: /archive/file.py
+      responses:
+        "200":
+          description: Files renamed/moved successfully
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "404":
+          $ref: "#/components/responses/NotFound"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+
+  /files/search:
+    get:
+      summary: Search for files
+      description: |
+        Searches for files matching a glob pattern within a specified directory and
+        its subdirectories. Returns file metadata including path, permissions, owner,
+        and group. Supports glob patterns like **, *.txt, etc. Default pattern is ** (all files).
+      operationId: searchFiles
+      tags:
+        - Filesystem
+      parameters:
+        - name: path
+          in: query
+          required: true
+          description: Root directory path to search in
+          schema:
+            type: string
+        - name: pattern
+          in: query
+          required: false
+          description: Glob pattern to match files (default is **)
+          schema:
+            type: string
+            default: "**"
+      responses:
+        "200":
+          description: Array of matching files with metadata
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: "#/components/schemas/FileInfo"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "404":
+          $ref: "#/components/responses/NotFound"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+
+  /files/replace:
+    post:
+      summary: Replace file content
+      description: |
+        Performs text replacement in one or multiple files. Replaces all occurrences
+        of the old string with the new string (similar to strings.ReplaceAll).
+        Preserves file permissions. Useful for batch text substitution across files.
+      operationId: replaceContent
+      tags:
+        - Filesystem
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              additionalProperties:
+                $ref: "#/components/schemas/ReplaceFileContentItem"
+            example:
+              "/workspace/config.yaml":
+                old: "localhost:8080"
+                new: "0.0.0.0:9090"
+              "/workspace/app.py":
+                old: "DEBUG = True"
+                new: "DEBUG = False"
+      responses:
+        "200":
+          description: Content replaced successfully
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+
+  /files/upload:
+    post:
+      summary: Upload files to sandbox
+      description: |
+        Uploads one or multiple files to specified paths within the sandbox.
+        Reads metadata and file content from multipart form parts in sequence.
+        Each file upload consists of two parts: a metadata part (JSON) followed
+        by the actual file part.
+      operationId: uploadFile
+      tags:
+        - Filesystem
+      requestBody:
+        required: true
+        content:
+          multipart/form-data:
+            schema:
+              type: object
+              properties:
+                metadata:
+                  type: string
+                  description: JSON-encoded file metadata (FileMetadata object)
+                  example: '{"path":"/workspace/file.txt","owner":"admin","group":"admin","mode":755}'
+                file:
+                  type: string
+                  format: binary
+                  description: File to upload
+            encoding:
+              metadata:
+                contentType: application/json
+              file:
+                contentType: application/octet-stream
+      responses:
+        "200":
+          description: Files uploaded successfully
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+
+  /files/download:
+    get:
+      summary: Download file from sandbox
+      description: |
+        Downloads a file from the specified path within the sandbox. Supports HTTP
+        range requests for resumable downloads and partial content retrieval.
+        Returns file as octet-stream with appropriate headers.
+      operationId: downloadFile
+      tags:
+        - Filesystem
+      parameters:
+        - name: path
+          in: query
+          required: true
+          description: Absolute or relative path of the file to download
+          schema:
+            type: string
+          example: /workspace/data.csv
+        - name: Range
+          in: header
+          required: false
+          description: HTTP Range header for partial content requests
+          schema:
+            type: string
+          example: "bytes=0-1023"
+      responses:
+        "200":
+          description: File content
+          content:
+            application/octet-stream:
+              schema:
+                type: string
+                format: binary
+          headers:
+            Content-Disposition:
+              schema:
+                type: string
+              description: Attachment header with filename
+            Content-Length:
+              schema:
+                type: integer
+              description: File size in bytes
+        "206":
+          description: Partial file content (when Range header is provided)
+          content:
+            application/octet-stream:
+              schema:
+                type: string
+                format: binary
+          headers:
+            Content-Range:
+              schema:
+                type: string
+              description: Range of bytes being returned
+            Content-Length:
+              schema:
+                type: integer
+              description: Length of the returned range
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "404":
+          $ref: "#/components/responses/NotFound"
+        "416":
+          description: Requested range not satisfiable
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/ErrorResponse"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+
+  /directories:
+    post:
+      summary: Create directories
+      description: |
+        Creates one or multiple directories with specified permissions. Creates parent
+        directories as needed (similar to mkdir -p). Accepts a map of directory paths
+        to permission objects.
+      operationId: makeDirs
+      tags:
+        - Filesystem
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              additionalProperties:
+                $ref: "#/components/schemas/Permission"
+            example:
+              "/workspace/project":
+                owner: admin
+                group: admin
+                mode: 755
+              "/workspace/logs":
+                owner: admin
+                group: admin
+                mode: 755
+      responses:
+        "200":
+          description: Directories created successfully
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+
+    delete:
+      summary: Delete directories
+      description: |
+        Recursively deletes one or multiple directories and all their contents.
+        Similar to rm -rf. Use with caution as this operation cannot be undone.
+      operationId: removeDirs
+      tags:
+        - Filesystem
+      parameters:
+        - name: path
+          in: query
+          required: true
+          description: Directory path(s) to delete (can be specified multiple times)
+          schema:
+            type: array
+            items:
+              type: string
+          style: form
+          explode: true
+          example: ["/workspace/temp"]
+      responses:
+        "200":
+          description: Directories deleted successfully
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+
+  /metrics:
+    get:
+      summary: Get system metrics
+      description: |
+        Retrieves current system resource metrics including CPU usage percentage,
+        CPU core count, total memory, used memory, and timestamp. Provides a snapshot
+        of system resource utilization at the time of request.
+      operationId: getMetrics
+      tags:
+        - Metric
+      responses:
+        "200":
+          description: Current system metrics including CPU and memory usage
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Metrics"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+
+  /metrics/watch:
+    get:
+      summary: Watch system metrics in real-time
+      description: |
+        Streams system resource metrics in real-time using Server-Sent Events (SSE).
+        Updates are sent every second, providing continuous monitoring of CPU usage,
+        memory usage, and other system metrics. The connection remains open until
+        the client disconnects.
+      operationId: watchMetrics
+      tags:
+        - Metric
+      responses:
+        "200":
+          description: Stream of system metrics updated every second
+          content:
+            text/event-stream:
+              schema:
+                $ref: "#/components/schemas/Metrics"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+
+components:
+  securitySchemes:
+    AccessToken:
+      type: apiKey
+      in: header
+      name: X-EXECD-ACCESS-TOKEN
+      description: |
+        Access token for API authentication. All requests must include this header
+        with a valid token. The token is configured during server initialization.
+
+  schemas:
+    CreateSessionRequest:
+      type: object
+      description: Request to create a bash session (optional body; empty treated as defaults)
+      properties:
+        cwd:
+          type: string
+          description: Working directory for the session (optional)
+          example: /workspace
+
+    SessionCreated:
+      type: object
+      description: Response for create_session
+      properties:
+        session_id:
+          type: string
+          description: Unique session ID for run_in_session and delete_session
+          example: session-abc123
+      required:
+        - session_id
+
+    RunInSessionRequest:
+      type: object
+      description: Request to run a command in an existing bash session
+      required:
+        - command
+      properties:
+        command:
+          type: string
+          description: Shell command to execute in the session
+          example: echo "Hello"
+        cwd:
+          type: string
+          description: Working directory override for this run (optional)
+          example: /workspace
+        timeout:
+          type: integer
+          format: int64
+          minimum: 0
+          description: Maximum execution time in milliseconds (optional; server may not enforce if omitted)
+          example: 30000
+
+    CodeContextRequest:
+      type: object
+      description: Request to create a code execution context
+      properties:
+        language:
+          type: string
+          description: Execution runtime (python, bash, java, etc.)
+          example: python
+
+    CodeContext:
+      type: object
+      description: Code execution context with session identifier
+      properties:
+        id:
+          type: string
+          description: Unique session identifier returned by CreateContext
+          example: session-abc123
+        language:
+          type: string
+          description: Execution runtime
+          example: python
+      required:
+        - language
+
+    RunCodeRequest:
+      type: object
+      required:
+        - code
+      description: Request to execute code in a context
+      properties:
+        context:
+          $ref: "#/components/schemas/CodeContext"
+        code:
+          type: string
+          description: Source code to execute
+          example: |
+            import numpy as np
+            result = np.array([1, 2, 3])
+            print(result)
+
+    RunCommandRequest:
+      type: object
+      required:
+        - command
+      description: Request to execute a shell command
+      properties:
+        command:
+          type: string
+          description: Shell command to execute
+          example: ls -la /workspace
+        cwd:
+          type: string
+          description: Working directory for command execution
+          example: /workspace
+        background:
+          type: boolean
+          description: Whether to run command in detached mode
+          default: false
+          example: false
+        timeout:
+          type: integer
+          format: int64
+          description: Maximum allowed execution time in milliseconds before the command is forcefully terminated by the server. If omitted, the server will not enforce any timeout.
+          example: 60000
+        uid:
+          type: integer
+          format: int32
+          minimum: 0
+          description: |
+            Unix user ID used to run the command. If `gid` is provided, `uid` is required.
+          example: 1000
+        gid:
+          type: integer
+          format: int32
+          minimum: 0
+          description: |
+            Unix group ID used to run the command. Requires `uid` to be provided.
+          example: 1000
+        envs:
+          type: object
+          description: Environment variables injected into the command process.
+          additionalProperties:
+            type: string
+          example:
+            PATH: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+            PYTHONUNBUFFERED: "1"
+
+    CommandStatusResponse:
+      type: object
+      description: Command execution status (foreground or background)
+      properties:
+        id:
+          type: string
+          description: Command ID returned by RunCommand
+          example: cmd-abc123
+        content:
+          type: string
+          description: Original command content
+          example: ls -la
+        running:
+          type: boolean
+          description: Whether the command is still running
+          example: false
+        exit_code:
+          type: integer
+          format: int32
+          nullable: true
+          description: Exit code if the command has finished
+          example: 0
+        error:
+          type: string
+          description: Error message if the command failed
+          example: permission denied
+        started_at:
+          type: string
+          format: date-time
+          description: Start time in RFC3339 format
+          example: "2025-12-22T09:08:05Z"
+        finished_at:
+          type: string
+          format: date-time
+          nullable: true
+          description: Finish time in RFC3339 format (null if still running)
+          example: "2025-12-22T09:08:09Z"
+
+    ServerStreamEvent:
+      type: object
+      description: Server-sent event for streaming execution output
+      properties:
+        type:
+          type: string
+          enum:
+            - init
+            - status
+            - error
+            - stdout
+            - stderr
+            - result
+            - execution_complete
+            - execution_count
+            - ping
+          description: Event type for client-side handling
+          example: stdout
+        text:
+          type: string
+          description: Textual data for status, init, and stream events
+          example: "Hello, World!\n"
+        execution_count:
+          type: integer
+          description: Cell execution number in the session
+          example: 1
+        execution_time:
+          type: integer
+          format: int64
+          description: Execution duration in milliseconds
+          example: 150
+        timestamp:
+          type: integer
+          format: int64
+          description: When the event was generated (Unix milliseconds)
+          example: 1700000000000
+        results:
+          type: object
+          additionalProperties: true
+          description: Execution output in various MIME types (e.g., "text/plain", "text/html")
+          example:
+            text/plain: "4"
+        error:
+          type: object
+          description: Execution error details if an error occurred
+          properties:
+            ename:
+              type: string
+              description: Error name/type
+              example: "NameError"
+            evalue:
+              type: string
+              description: Error value/message
+              example: "name 'undefined_var' is not defined"
+            traceback:
+              type: array
+              items:
+                type: string
+              description: Stack trace lines
+              example:
+                - "Traceback (most recent call last):"
+                - '  File "<stdin>", line 1, in <module>'
+                - "NameError: name 'undefined_var' is not defined"
+
+    FileInfo:
+      type: object
+      description: File metadata including path and permissions
+      properties:
+        path:
+          type: string
+          description: Absolute file path
+          example: /workspace/file.txt
+        size:
+          type: integer
+          format: int64
+          description: File size in bytes
+          example: 2048
+        modified_at:
+          type: string
+          format: date-time
+          description: Last modification time
+          example: 2025-11-16T14:30:45Z
+        created_at:
+          type: string
+          format: date-time
+          description: File creation time
+          example: 2025-11-16T14:30:45Z
+        owner:
+          type: string
+          description: File owner username
+          example: admin
+        group:
+          type: string
+          description: File group name
+          example: admin
+        mode:
+          type: integer
+          description: File permissions in octal format
+          example: 755
+      required: [path, size, modified_at, created_at, owner, group, mode]
+
+    Permission:
+      type: object
+      description: File ownership and mode settings
+      properties:
+        owner:
+          type: string
+          description: Owner username
+          example: root
+        group:
+          type: string
+          description: Group name
+          example: root
+        mode:
+          type: integer
+          description: Permission mode in octal format (e.g., 644, 755)
+          default: 755
+          example: 755
+      required: [mode]
+
+    FileMetadata:
+      type: object
+      description: File metadata for upload operations
+      properties:
+        path:
+          type: string
+          description: Target file path
+          example: /workspace/upload.txt
+        owner:
+          type: string
+          description: File owner
+          example: admin
+        group:
+          type: string
+          description: File group
+          example: admin
+        mode:
+          type: integer
+          description: File permissions in octal
+          example: 755
+
+    RenameFileItem:
+      type: object
+      description: File rename/move operation
+      properties:
+        src:
+          type: string
+          description: Source file path
+          example: /workspace/old.txt
+        dest:
+          type: string
+          description: Destination file path
+          example: /workspace/new.txt
+      required: [src, dest]
+
+    ReplaceFileContentItem:
+      type: object
+      description: Content replacement operation
+      properties:
+        old:
+          type: string
+          description: String to be replaced
+          example: "localhost"
+        new:
+          type: string
+          description: Replacement string
+          example: "0.0.0.0"
+      required: [old, new]
+
+    Metrics:
+      type: object
+      description: System resource usage metrics
+      properties:
+        cpu_count:
+          type: number
+          format: float
+          description: Number of CPU cores
+          example: 4.0
+        cpu_used_pct:
+          type: number
+          format: float
+          description: CPU usage percentage
+          example: 45.5
+        mem_total_mib:
+          type: number
+          format: float
+          description: Total memory in MiB
+          example: 8192.0
+        mem_used_mib:
+          type: number
+          format: float
+          description: Used memory in MiB
+          example: 4096.0
+        timestamp:
+          type: integer
+          format: int64
+          description: Timestamp when metrics were collected (Unix milliseconds)
+          example: 1700000000000
+      required:
+        [cpu_count, cpu_used_pct, mem_total_mib, mem_used_mib, timestamp]
+
+    ErrorResponse:
+      type: object
+      description: Standard error response format
+      properties:
+        code:
+          type: string
+          description: Error code for programmatic handling
+          example: INVALID_REQUEST_BODY
+        message:
+          type: string
+          description: Human-readable error message
+          example: "error parsing request, MAYBE invalid body format"
+      required: [code, message]
+
+  responses:
+    BadRequest:
+      description: Invalid request body format or missing required fields
+      content:
+        application/json:
+          schema:
+            $ref: "#/components/schemas/ErrorResponse"
+          example:
+            code: INVALID_REQUEST_BODY
+            message: "error parsing request, MAYBE invalid body format"
+
+    NotFound:
+      description: File or resource not found
+      content:
+        application/json:
+          schema:
+            $ref: "#/components/schemas/ErrorResponse"
+          example:
+            code: FILE_NOT_FOUND
+            message: "file not found"
+
+    InternalServerError:
+      description: Runtime server error during operation
+      content:
+        application/json:
+          schema:
+            $ref: "#/components/schemas/ErrorResponse"
+          example:
+            code: RUNTIME_ERROR
+            message: "error running code execution"
diff --git a/sdks/sandbox/go/opensandbox/api/specs/sandbox-lifecycle.yml b/sdks/sandbox/go/opensandbox/api/specs/sandbox-lifecycle.yml
new file mode 100644
index 00000000..7a2de29f
--- /dev/null
+++ b/sdks/sandbox/go/opensandbox/api/specs/sandbox-lifecycle.yml
@@ -0,0 +1,1028 @@
+openapi: 3.0.3
+info:
+  title: OpenSandbox Lifecycle API
+  version: 0.1.0
+  description: |
+    The Sandbox Lifecycle API coordinates how untrusted workloads are created,
+    executed, paused, resumed, and finally disposed. This specification focuses on
+    the primary lifecycle flows for the `sandbox` domain concept. Sandboxes are
+    provisioned directly from container images without requiring pre-created templates.
+
+    ## Sandbox Lifecycle
+
+    A sandbox follows this lifecycle:
+
+    1. **Creation** → Sandbox enters `Pending` state (auto-starts)
+    2. **Execution** → Transitions to `Running` state
+    3. **Pause** (optional) → `Pausing` → `Paused` (asynchronous process)
+    4. **Resume** (optional) → Returns to `Running` from `Paused`
+    5. **Termination** → `Stopping` → `Terminated` (can be triggered by kill action, TTL expiry, or error)
+    6. **Error** → Any state can transition to `Failed` on critical errors
+
+    The `status` field provides fine-grained details through `state`, `reason`, and `message`.
+
+    ## Authentication
+
+    API Key authentication is required for all operations:
+
+    1. **HTTP Header**
+       ```
+       OPEN-SANDBOX-API-KEY: your-api-key
+       ```
+
+    2. **Environment Variable** (for SDK clients)
+       ```
+       OPEN_SANDBOX_API_KEY=your-api-key
+       ```
+
+       SDK clients will automatically pick up this environment variable.
+servers:
+  - url: http://localhost:8080/v1
+    description: Local development
+security:
+  - apiKeyAuth: []
+tags:
+  - name: Sandboxes
+    description: Provision and transition sandboxes through their lifecycle
+paths:
+  /sandboxes:
+    get:
+      tags: [ Sandboxes ]
+      summary: List sandboxes
+      description: |
+        List all sandboxes with optional filtering and pagination using query parameters.
+        All filter conditions use AND logic. Multiple `state` parameters use OR logic within states.
+      parameters:
+        - name: state
+          in: query
+          description: |
+            Filter by lifecycle state. Pass multiple times for OR logic.
+            Example: `?state=Running&state=Paused`
+          schema:
+            type: array
+            items:
+              type: string
+          style: form
+          explode: true
+        - name: metadata
+          in: query
+          description: |
+            Arbitrary metadata key-value pairs for filtering，keys and values must be url encoded
+            Example: To filter by `project=Apollo` and `note=Demo Test`: `?metadata=project%3DApollo%26note%3DDemo%252520Test`
+          schema:
+            type: string
+          style: form
+        - name: page
+          in: query
+          description: Page number for pagination
+          schema:
+            type: integer
+            minimum: 1
+            default: 1
+        - name: pageSize
+          in: query
+          description: Number of items per page
+          schema:
+            type: integer
+            minimum: 1
+            default: 20
+      responses:
+        '200':
+          description: Paginated collection of sandboxes
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/ListSandboxesResponse'
+          headers:
+            X-Request-ID:
+              $ref: '#/components/headers/XRequestId'
+        '400':
+          $ref: '#/components/responses/BadRequest'
+        '401':
+          $ref: '#/components/responses/Unauthorized'
+        '500':
+          $ref: '#/components/responses/InternalServerError'
+    post:
+      tags: [Sandboxes]
+      summary: Create a sandbox from a container image
+      description: |
+        Creates a new sandbox from a container image with optional resource limits,
+        environment variables, and metadata. Sandboxes are provisioned directly from
+        the specified image without requiring a pre-created template.
+
+        ## Authentication
+
+        API Key authentication is required via:
+        - `OPEN-SANDBOX-API-KEY: <api-key>` header
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/CreateSandboxRequest'
+            examples:
+              deny-with-allowlist:
+                summary: Deny by default with allowed domains
+                value:
+                  image:
+                    uri: python:3.11
+                  timeout: 3600
+                  resourceLimits:
+                    cpu: "500m"
+                    memory: "512Mi"
+                  entrypoint: ["python", "/app/main.py"]
+                  networkPolicy:
+                    defaultAction: deny
+                    egress:
+                      - action: allow
+                        target: "pypi.org"
+              allow-with-denylist:
+                summary: Allow by default with a deny rule
+                value:
+                  image:
+                    uri: python:3.11
+                  timeout: 3600
+                  resourceLimits:
+                    cpu: "500m"
+                    memory: "512Mi"
+                  entrypoint: ["python", "/app/main.py"]
+                  networkPolicy:
+                    defaultAction: allow
+                    egress:
+                      - action: deny
+                        target: "bad.example.com"
+              manual-cleanup:
+                summary: Manual cleanup without automatic expiration
+                value:
+                  image:
+                    uri: python:3.11
+                  resourceLimits:
+                    cpu: "500m"
+                    memory: "512Mi"
+                  entrypoint: ["python", "/app/main.py"]
+      responses:
+        '202':
+          description: |
+            Sandbox created and accepted for provisioning.
+
+            The returned sandbox includes:
+            - `id`: Unique sandbox identifier
+            - `status.state: "Pending"` (auto-starting provisioning)
+            - `status.reason` and `status.message` indicating initialization stage
+            - `metadata`, `expiresAt`, `createdAt`: Core sandbox information
+
+            Note: `image` and `updatedAt` are not included in the create response.
+            Use GET /sandboxes/{sandboxId} to retrieve the complete sandbox information including image spec.
+
+            To track provisioning progress, poll GET /sandboxes/{sandboxId}.
+            The sandbox will automatically transition to `Running` state once provisioning completes.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/CreateSandboxResponse'
+          headers:
+            X-Request-ID:
+              $ref: '#/components/headers/XRequestId'
+            Location:
+              $ref: '#/components/headers/Location'
+        '400':
+          $ref: '#/components/responses/BadRequest'
+        '401':
+          $ref: '#/components/responses/Unauthorized'
+        '409':
+          $ref: '#/components/responses/Conflict'
+        '500':
+          $ref: '#/components/responses/InternalServerError'
+  /sandboxes/{sandboxId}:
+    parameters:
+      - $ref: '#/components/parameters/SandboxId'
+    get:
+      tags: [Sandboxes]
+      summary: Fetch a sandbox by id
+      description: |
+        Returns the complete sandbox information including:
+        - `id`, `status`, `metadata`, `expiresAt`, `createdAt`: Core information
+        - `image`: Container image specification (not included in create response)
+        - `entrypoint`: Entry process specification
+
+        This is the complete representation of the sandbox resource.
+      responses:
+        '200':
+          description: Sandbox current state and metadata
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Sandbox'
+          headers:
+            X-Request-ID:
+              $ref: '#/components/headers/XRequestId'
+        '401':
+          $ref: '#/components/responses/Unauthorized'
+        '403':
+          $ref: '#/components/responses/Forbidden'
+        '404':
+          $ref: '#/components/responses/NotFound'
+        '500':
+          $ref: '#/components/responses/InternalServerError'
+    delete:
+      tags: [Sandboxes]
+      summary: Delete a sandbox
+      description: Delete a sandbox, terminating its execution. The sandbox will transition through Stopping state to Terminated.
+      responses:
+        '204':
+          description: |
+            Sandbox successfully deleted.
+
+            Sandbox has been scheduled for termination and will transition to Stopping state, then Terminated.
+          headers:
+            X-Request-ID:
+              $ref: '#/components/headers/XRequestId'
+        '401':
+          $ref: '#/components/responses/Unauthorized'
+        '403':
+          $ref: '#/components/responses/Forbidden'
+        '404':
+          $ref: '#/components/responses/NotFound'
+        '409':
+          $ref: '#/components/responses/Conflict'
+        '500':
+          $ref: '#/components/responses/InternalServerError'
+  /sandboxes/{sandboxId}/pause:
+    post:
+      tags: [Sandboxes]
+      summary: Pause execution while retaining state
+      description: Pause a running sandbox while preserving its state. Poll GET /sandboxes/{sandboxId} to track state transition to Paused.
+      parameters:
+        - $ref: '#/components/parameters/SandboxId'
+      responses:
+        '202':
+          description: |
+            Pause operation accepted.
+
+            Sandbox will transition to Pausing state.
+            Poll GET /sandboxes/{sandboxId} to track progress.
+          headers:
+            X-Request-ID:
+              $ref: '#/components/headers/XRequestId'
+        '401':
+          $ref: '#/components/responses/Unauthorized'
+        '403':
+          $ref: '#/components/responses/Forbidden'
+        '404':
+          $ref: '#/components/responses/NotFound'
+        '409':
+          $ref: '#/components/responses/Conflict'
+        '500':
+          $ref: '#/components/responses/InternalServerError'
+  /sandboxes/{sandboxId}/resume:
+    post:
+      tags: [Sandboxes]
+      summary: Resume a paused sandbox
+      description: Resume execution of a paused sandbox. Poll GET /sandboxes/{sandboxId} to track state transition to Running.
+      parameters:
+        - $ref: '#/components/parameters/SandboxId'
+      responses:
+        '202':
+          description: |
+            Resume operation accepted.
+
+            Sandbox will transition from Paused → Running.
+            Poll GET /sandboxes/{sandboxId} to track progress.
+          headers:
+            X-Request-ID:
+              $ref: '#/components/headers/XRequestId'
+        '401':
+          $ref: '#/components/responses/Unauthorized'
+        '403':
+          $ref: '#/components/responses/Forbidden'
+        '404':
+          $ref: '#/components/responses/NotFound'
+        '409':
+          $ref: '#/components/responses/Conflict'
+        '500':
+          $ref: '#/components/responses/InternalServerError'
+  /sandboxes/{sandboxId}/renew-expiration:
+    post:
+      tags: [Sandboxes]
+      summary: Renew sandbox expiration
+      description: Renew the absolute expiration time of a sandbox.
+      parameters:
+        - $ref: '#/components/parameters/SandboxId'
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/RenewSandboxExpirationRequest'
+      responses:
+        '200':
+          description: |
+            Sandbox expiration updated successfully.
+
+            Returns only the updated expiresAt field.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenewSandboxExpirationResponse'
+          headers:
+            X-Request-ID:
+              $ref: '#/components/headers/XRequestId'
+        '400':
+          $ref: '#/components/responses/BadRequest'
+        '401':
+          $ref: '#/components/responses/Unauthorized'
+        '403':
+          $ref: '#/components/responses/Forbidden'
+        '404':
+          $ref: '#/components/responses/NotFound'
+        '409':
+          $ref: '#/components/responses/Conflict'
+        '500':
+          $ref: '#/components/responses/InternalServerError'
+  /sandboxes/{sandboxId}/endpoints/{port}:
+    get:
+      tags: [Sandboxes]
+      summary: Get sandbox access endpoint
+      description: |
+        Get the public access endpoint URL for accessing a service running on a specific port
+        within the sandbox. The service must be listening on the specified port inside
+        the sandbox for the endpoint to be available.
+      parameters:
+        - $ref: '#/components/parameters/SandboxId'
+        - name: port
+          in: path
+          required: true
+          description: Port number where the service is listening inside the sandbox
+          schema:
+            type: integer
+            minimum: 1
+            maximum: 65535
+        - name: use_server_proxy
+          in: query
+          description: Whether to return a server-proxied URL
+          schema:
+            type: boolean
+            default: false
+      responses:
+        '200':
+          description: |
+            Endpoint retrieved successfully.
+
+            Returns the public URL for accessing the service on the specified port.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Endpoint'
+          headers:
+            X-Request-ID:
+              $ref: '#/components/headers/XRequestId'
+        '401':
+          $ref: '#/components/responses/Unauthorized'
+        '403':
+          $ref: '#/components/responses/Forbidden'
+        '404':
+          $ref: '#/components/responses/NotFound'
+        '500':
+          $ref: '#/components/responses/InternalServerError'
+components:
+  securitySchemes:
+    apiKeyAuth:
+      type: apiKey
+      in: header
+      name: OPEN-SANDBOX-API-KEY
+      description: |
+        API Key for authentication. Can be provided via:
+        1. HTTP Header: OPEN-SANDBOX-API-KEY: your-api-key
+        2. Environment variable: OPEN_SANDBOX_API_KEY (for SDK clients)
+  parameters:
+    SandboxId:
+      name: sandboxId
+      in: path
+      required: true
+      description: Unique sandbox identifier
+      schema:
+        type: string
+  headers:
+    XRequestId:
+      description: Unique request identifier for tracing
+      schema:
+        type: string
+        format: uuid
+    Location:
+      description: URI of the newly created or related resource
+      schema:
+        type: string
+        format: uri
+    RetryAfter:
+      description: Suggested delay in seconds before retrying
+      schema:
+        type: integer
+        minimum: 1
+  responses:
+    Error:
+      description: Error response envelope
+      content:
+        application/json:
+          schema:
+            $ref: '#/components/schemas/ErrorResponse'
+    BadRequest:
+      description: The request was invalid or malformed
+      content:
+        application/json:
+          schema:
+            $ref: '#/components/schemas/ErrorResponse'
+      headers:
+        X-Request-ID:
+          $ref: '#/components/headers/XRequestId'
+    Unauthorized:
+      description: Authentication credentials are missing or invalid
+      content:
+        application/json:
+          schema:
+            $ref: '#/components/schemas/ErrorResponse'
+      headers:
+        X-Request-ID:
+          $ref: '#/components/headers/XRequestId'
+    Forbidden:
+      description: The authenticated user lacks permission for this operation
+      content:
+        application/json:
+          schema:
+            $ref: '#/components/schemas/ErrorResponse'
+      headers:
+        X-Request-ID:
+          $ref: '#/components/headers/XRequestId'
+    NotFound:
+      description: The requested resource does not exist
+      content:
+        application/json:
+          schema:
+            $ref: '#/components/schemas/ErrorResponse'
+      headers:
+        X-Request-ID:
+          $ref: '#/components/headers/XRequestId'
+    Conflict:
+      description: The operation conflicts with the current state
+      content:
+        application/json:
+          schema:
+            $ref: '#/components/schemas/ErrorResponse'
+      headers:
+        X-Request-ID:
+          $ref: '#/components/headers/XRequestId'
+    InternalServerError:
+      description: An unexpected server error occurred
+      content:
+        application/json:
+          schema:
+            $ref: '#/components/schemas/ErrorResponse'
+      headers:
+        X-Request-ID:
+          $ref: '#/components/headers/XRequestId'
+  schemas:
+    ListSandboxesResponse:
+      type: object
+      properties:
+        items:
+          type: array
+          items:
+            $ref: '#/components/schemas/Sandbox'
+        pagination:
+          $ref: '#/components/schemas/PaginationInfo'
+      required: [items, pagination]
+    PaginationInfo:
+      type: object
+      description: Pagination metadata for list responses
+      properties:
+        page:
+          type: integer
+          minimum: 1
+          description: Current page number
+        pageSize:
+          type: integer
+          minimum: 1
+          description: Number of items per page
+        totalItems:
+          type: integer
+          minimum: 0
+          description: Total number of items matching the filter
+        totalPages:
+          type: integer
+          minimum: 0
+          description: Total number of pages
+        hasNextPage:
+          type: boolean
+          description: Whether there are more pages after the current one
+      required: [page, pageSize, totalItems, totalPages, hasNextPage]
+    CreateSandboxResponse:
+      type: object
+      description: Response from creating a new sandbox. Contains essential information without image and updatedAt.
+      properties:
+        id:
+          type: string
+          description: Unique sandbox identifier
+
+        status:
+          $ref: '#/components/schemas/SandboxStatus'
+          description: Current lifecycle status and detailed state information
+
+        metadata:
+          type: object
+          additionalProperties:
+            type: string
+          description: Custom metadata from creation request
+
+        expiresAt:
+          type: string
+          format: date-time
+          description: Timestamp when sandbox will auto-terminate. Omitted when manual cleanup is enabled.
+
+        createdAt:
+          type: string
+          format: date-time
+          description: Sandbox creation timestamp
+
+        entrypoint:
+          type: array
+          items:
+            type: string
+          description: Entry process specification from creation request
+
+      required:
+        - id
+        - status
+        - createdAt
+        - entrypoint
+
+    Sandbox:
+      type: object
+      description: Runtime execution environment provisioned from a container image
+      properties:
+        id:
+          type: string
+          description: Unique sandbox identifier
+
+        image:
+          $ref: '#/components/schemas/ImageSpec'
+          description: |
+            Container image specification used to provision this sandbox.
+            Only present in responses for GET/LIST operations. Not returned in createSandbox response.
+
+        status:
+          $ref: '#/components/schemas/SandboxStatus'
+          description: Current lifecycle status and detailed state information
+
+        metadata:
+          type: object
+          additionalProperties:
+            type: string
+          description: Custom metadata from creation request
+
+        entrypoint:
+          type: array
+          items:
+            type: string
+          description: |
+            The command to execute as the sandbox's entry process.
+            Always present in responses since entrypoint is required in creation requests.
+
+        expiresAt:
+          type: string
+          format: date-time
+          description: Timestamp when sandbox will auto-terminate. Omitted when manual cleanup is enabled.
+
+        createdAt:
+          type: string
+          format: date-time
+          description: Sandbox creation timestamp
+
+      required:
+        - id
+        - status
+        - createdAt
+        - entrypoint
+        - image
+    SandboxState:
+      type: string
+      description: |
+        High-level lifecycle state of the sandbox.
+
+        Common state values:
+        - Pending: Sandbox is being provisioned
+        - Running: Sandbox is running and ready to accept requests
+        - Pausing: Sandbox is in the process of pausing
+        - Paused: Sandbox has been paused while retaining its state
+        - Stopping: Sandbox is being terminated
+        - Terminated: Sandbox has been successfully terminated
+        - Failed: Sandbox encountered a critical error
+
+        State transitions:
+        - Pending → Running (after creation completes)
+        - Running → Pausing (when pause is requested)
+        - Pausing → Paused (pause operation completes)
+        - Paused → Running (when resume is requested)
+        - Running/Paused → Stopping (when kill is requested or TTL expires)
+        - Stopping → Terminated (kill/timeout operation completes)
+        - Pending/Running/Paused → Failed (on error)
+
+        Note: New state values may be added in future versions.
+        Clients should handle unknown state values gracefully.
+    SandboxStatus:
+      type: object
+      description: Detailed status information with lifecycle state and transition details
+      properties:
+        state:
+          $ref: '#/components/schemas/SandboxState'
+          description: Current lifecycle state of the sandbox
+
+        reason:
+          type: string
+          description: |
+            Short machine-readable reason code for the current state.
+            Examples: "user_delete", "ttl_expiry", "provision_timeout", "runtime_error"
+
+        message:
+          type: string
+          description: Human-readable message describing the current state or reason for state transition
+
+        lastTransitionAt:
+          type: string
+          format: date-time
+          description: Timestamp of the last state transition
+
+      required: [state]
+    ImageSpec:
+      type: object
+      required: [uri]
+      description: |
+        Container image specification for sandbox provisioning.
+
+        Supports public registry images and private registry images with authentication.
+      properties:
+        uri:
+          type: string
+          description: |
+            Container image URI in standard format.
+
+            Examples:
+              - "python:3.11" (Docker Hub)
+              - "ubuntu:22.04"
+              - "gcr.io/my-project/model-server:v1.0"
+              - "private-registry.company.com:5000/app:latest"
+
+        auth:
+          type: object
+          description: Registry authentication credentials (required for private registries)
+          properties:
+            username:
+              type: string
+              description: Registry username or service account
+            password:
+              type: string
+              description: Registry password or authentication token
+          additionalProperties: false
+
+      additionalProperties: false
+    CreateSandboxRequest:
+      type: object
+      required: [image, resourceLimits, entrypoint]
+      description: |
+        Request to create a new sandbox from a container image.
+
+        **Note**: API Key authentication is required via the `OPEN-SANDBOX-API-KEY` header.
+      properties:
+        image:
+          $ref: '#/components/schemas/ImageSpec'
+          description: Container image specification for the sandbox
+
+        timeout:
+          type: integer
+          minimum: 60
+          nullable: true
+          description: |
+            Sandbox timeout in seconds. The sandbox will automatically terminate after this duration.
+            The maximum is controlled by the server configuration (`server.max_sandbox_timeout_seconds`).
+            Omit this field or set it to null to disable automatic expiration and require explicit cleanup.
+            Note: manual cleanup support is runtime-dependent; Kubernetes providers may reject
+            omitted or null timeout when the underlying workload provider does not support non-expiring sandboxes.
+
+        resourceLimits:
+          $ref: '#/components/schemas/ResourceLimits'
+          description: |
+            Runtime resource constraints for the sandbox instance.
+            SDK clients should provide sensible defaults (e.g., cpu: "500m", memory: "512Mi").
+
+        env:
+          type: object
+          additionalProperties:
+            type: string
+          description: Environment variables to inject into the sandbox runtime.
+          example:
+            API_KEY: "secret-key"
+            DEBUG: "true"
+            LOG_LEVEL: "info"
+
+        metadata:
+          type: object
+          additionalProperties:
+            type: string
+          description: |
+            Custom key-value metadata for management, filtering, and tagging.
+            Use "name" key for a human-readable identifier.
+          example:
+            name: "Data Processing Sandbox"
+            project: "data-processing"
+            team: "ml"
+            environment: "staging"
+
+        entrypoint:
+          type: array
+          items:
+            type: string
+          minItems: 1
+          description: |
+            The command to execute as the sandbox's entry process (required).
+
+            Explicitly specifies the user's expected main process, allowing the sandbox management
+            service to reliably inject control processes before executing this command.
+
+            Format: [executable, arg1, arg2, ...]
+
+            Examples:
+            - ["python", "/app/main.py"]
+            - ["/bin/bash"]
+            - ["java", "-jar", "/app/app.jar"]
+            - ["node", "server.js"]
+          example:
+            - "python"
+            - "/app/main.py"
+
+        networkPolicy:
+          $ref: '#/components/schemas/NetworkPolicy'
+          description: |
+            Optional outbound network policy for the sandbox.
+            Shape matches the sidecar `/policy` endpoint. If omitted or empty,
+            the sidecar starts in allow-all mode until updated.
+
+        volumes:
+          type: array
+          description: |
+            Storage mounts for the sandbox. Each volume entry specifies a named backend-specific
+            storage source and common mount settings. Exactly one backend type must be specified
+            per volume entry.
+          items:
+            $ref: '#/components/schemas/Volume'
+
+        extensions:
+          type: object
+          additionalProperties:
+            type: string
+          description: |
+            Opaque container for provider-specific or transient parameters not supported by the core API.
+
+            **Note**: This field is reserved for internal features, experimental flags, or temporary behaviors. Standard parameters should be proposed as core API fields.
+
+            **Best Practices**:
+            - **Namespacing**: Use prefixed keys (e.g., `storage.id`) to prevent collisions.
+            - **Pass-through**: SDKs and middleware must treat this object as opaque and pass it through transparently.
+
+            **Well-known keys**:
+            - `access.renew.extend.seconds` (optional): Decimal integer string from **300** to **86400** (5 minutes to 24 hours inclusive). Opts the sandbox into OSEP-0009 renew-on-access and sets per-renewal extension seconds. Omit to disable. Invalid values are rejected at creation with HTTP 400 (validated on the lifecycle create endpoint via `validate_extensions` in server `src/extensions/validation.py`).
+    ResourceLimits:
+      type: object
+      description: |
+        Runtime resource constraints as key-value pairs. Similar to Kubernetes resource specifications,
+        allows flexible definition of resource limits. Common resource types include:
+        - `cpu`: CPU allocation in millicores (e.g., "250m" for 0.25 CPU cores)
+        - `memory`: Memory allocation in bytes or human-readable format (e.g., "512Mi", "1Gi")
+        - `gpu`: Number of GPU devices (e.g., "1")
+
+        New resource types can be added without API changes.
+      additionalProperties:
+        type: string
+      example:
+        cpu: "500m"
+        memory: "512Mi"
+        gpu: "1"
+    RenewSandboxExpirationRequest:
+      type: object
+      required: [expiresAt]
+      properties:
+        expiresAt:
+          type: string
+          format: date-time
+          description: |
+            New absolute expiration time in UTC (RFC 3339 format).
+            Must be in the future and after the current expiresAt time.
+
+            Example: "2025-11-16T14:30:45Z"
+      additionalProperties: false
+    RenewSandboxExpirationResponse:
+      type: object
+      required: [expiresAt]
+      properties:
+        expiresAt:
+          type: string
+          format: date-time
+          description: |
+            The new absolute expiration time in UTC (RFC 3339 format).
+
+            Example: "2025-11-16T14:30:45Z"
+      additionalProperties: false
+    ErrorResponse:
+      type: object
+      description: |
+        Standard error response for all non-2xx HTTP responses.
+        HTTP status code indicates the error category; code and message provide details.
+      properties:
+        code:
+          type: string
+          description: |
+            Machine-readable error code (e.g., INVALID_REQUEST, NOT_FOUND, INTERNAL_ERROR).
+            Use this for programmatic error handling.
+        message:
+          type: string
+          description: Human-readable error message describing what went wrong and how to fix it.
+      required: [code, message]
+      additionalProperties: false
+    Endpoint:
+      type: object
+      description: |
+        Endpoint for accessing a service running in the sandbox.
+        The service must be listening on the specified port inside the sandbox for the endpoint to be available.
+      properties:
+        endpoint:
+          type: string
+          description: |
+            Public URL to access the service from outside the sandbox.
+            Format: {endpoint-host}/sandboxes/{sandboxId}/port/{port}
+            Example: endpoint.opensandbox.io/sandboxes/abc123/port/8080
+        headers:
+          type: object
+          additionalProperties:
+            type: string
+          description: |
+            Requests targeting the sandbox must include the corresponding header(s).
+      required:
+        - endpoint
+      additionalProperties: false
+
+    NetworkPolicy:
+      type: object
+      description: |
+        Egress network policy matching the sidecar `/policy` request body.
+        If `defaultAction` is omitted, the sidecar defaults to "deny"; passing an empty
+        object or null results in allow-all behavior at startup.
+      properties:
+        defaultAction:
+          type: string
+          enum: [allow, deny]
+          description: Default action when no egress rule matches. Defaults to "deny".
+        egress:
+          type: array
+          description: List of egress rules evaluated in order.
+          items:
+            $ref: '#/components/schemas/NetworkRule'
+      additionalProperties: false
+
+    NetworkRule:
+      type: object
+      properties:
+        action:
+          type: string
+          enum: [allow, deny]
+          description: Whether to allow or deny matching targets.
+        target:
+          type: string
+          description: |
+            FQDN or wildcard domain (e.g., "example.com", "*.example.com").
+            IP/CIDR not yet supported in the egress MVP.
+      required: [action, target]
+      additionalProperties: false
+
+    Volume:
+      type: object
+      description: |
+        Storage mount definition for a sandbox. Each volume entry contains:
+        - A unique name identifier
+        - Exactly one backend struct (host, pvc, ossfs, etc.) with backend-specific fields
+        - Common mount settings (mountPath, readOnly, subPath)
+      required: [name, mountPath]
+      properties:
+        name:
+          type: string
+          description: |
+            Unique identifier for the volume within the sandbox.
+            Must be a valid DNS label (lowercase alphanumeric, hyphens allowed, max 63 chars).
+          pattern: "^[a-z0-9]([-a-z0-9]*[a-z0-9])?$"
+          maxLength: 63
+        host:
+          $ref: '#/components/schemas/Host'
+        pvc:
+          $ref: '#/components/schemas/PVC'
+        ossfs:
+          $ref: '#/components/schemas/OSSFS'
+        mountPath:
+          type: string
+          description: |
+            Absolute path inside the container where the volume is mounted.
+            Must start with '/'.
+          pattern: "^/.*"
+        readOnly:
+          type: boolean
+          description: |
+            If true, the volume is mounted as read-only. Defaults to false (read-write).
+          default: false
+        subPath:
+          type: string
+          description: |
+            Optional subdirectory under the backend path to mount.
+            For `ossfs` backend, this field is used as the bucket prefix.
+            Must be a relative path without '..' components.
+      additionalProperties: false
+
+    Host:
+      type: object
+      description: |
+        Host path bind mount backend. Maps a directory on the host filesystem
+        into the container. Only available when the runtime supports host mounts.
+
+        Security note: Host paths are restricted by server-side allowlist.
+        Users must specify paths under permitted prefixes.
+      required: [path]
+      properties:
+        path:
+          type: string
+          description: |
+            Absolute path on the host filesystem to mount.
+            Must start with '/' and be under an allowed prefix.
+          pattern: "^/.*"
+      additionalProperties: false
+
+    PVC:
+      type: object
+      description: |
+        Platform-managed named volume backend. A runtime-neutral abstraction
+        for referencing a pre-existing, platform-managed named volume.
+
+        - Kubernetes: maps to a PersistentVolumeClaim in the same namespace.
+        - Docker: maps to a Docker named volume (created via `docker volume create`).
+
+        The volume must already exist on the target platform before sandbox
+        creation.
+      required: [claimName]
+      properties:
+        claimName:
+          type: string
+          description: |
+            Name of the volume on the target platform.
+            In Kubernetes this is the PVC name; in Docker this is the named
+            volume name. Must be a valid DNS label.
+          pattern: "^[a-z0-9]([-a-z0-9]*[a-z0-9])?$"
+          maxLength: 253
+      additionalProperties: false
+
+    OSSFS:
+      type: object
+      description: |
+        Alibaba Cloud OSS mount backend via ossfs.
+
+        The runtime mounts a host-side OSS path under `storage.ossfs_mount_root`
+        and bind-mounts the resolved path into the sandbox container.
+        Prefix selection is expressed via `Volume.subPath`.
+        In Docker runtime, OSSFS backend requires OpenSandbox Server to run on a Linux host with FUSE support.
+      required: [bucket, endpoint, accessKeyId, accessKeySecret]
+      properties:
+        bucket:
+          type: string
+          description: OSS bucket name.
+          minLength: 3
+          maxLength: 63
+        endpoint:
+          type: string
+          description: OSS endpoint (e.g., `oss-cn-hangzhou.aliyuncs.com`).
+          minLength: 1
+        version:
+          type: string
+          description: ossfs major version used by runtime mount integration.
+          enum: ["1.0", "2.0"]
+          default: "2.0"
+        options:
+          type: array
+          description: |
+            Additional ossfs mount options.
+            Runtime encodes options by `version`:
+            - `1.0`: mounts with `ossfs ... -o <option>`
+            - `2.0`: mounts with `ossfs2 mount ... -c <config-file>` and encodes options as `--<option>` lines in the config file
+            Option values must be provided as raw payloads without leading `-`.
+          items:
+            type: string
+        accessKeyId:
+          type: string
+          description: OSS access key ID for inline credentials mode.
+          minLength: 1
+        accessKeySecret:
+          type: string
+          description: OSS access key secret for inline credentials mode.
+          minLength: 1
+      additionalProperties: false
diff --git a/sdks/sandbox/go/opensandbox/code_interpreter.go b/sdks/sandbox/go/opensandbox/code_interpreter.go
new file mode 100644
index 00000000..f06ba29f
--- /dev/null
+++ b/sdks/sandbox/go/opensandbox/code_interpreter.go
@@ -0,0 +1,107 @@
+package opensandbox
+
+import (
+	"context"
+	"time"
+)
+
+// CodeInterpreterImage is the default container image for the code interpreter.
+const CodeInterpreterImage = "opensandbox/code-interpreter:latest"
+
+// CodeInterpreterEntrypoint is the default entrypoint for the code interpreter.
+var CodeInterpreterEntrypoint = []string{"/opt/opensandbox/code-interpreter.sh"}
+
+// CodeInterpreterCreateOptions configures code interpreter creation.
+type CodeInterpreterCreateOptions struct {
+	// Image overrides the default code-interpreter image.
+	Image string
+
+	// Entrypoint overrides the default code-interpreter entrypoint.
+	Entrypoint []string
+
+	// ResourceLimits for the sandbox. Defaults to DefaultResourceLimits.
+	ResourceLimits ResourceLimits
+
+	// TimeoutSeconds is the sandbox TTL. Defaults to 900 (15 min).
+	TimeoutSeconds *int
+
+	// Env variables injected into the sandbox.
+	Env map[string]string
+
+	// Metadata for filtering and tagging.
+	Metadata map[string]string
+
+	// SkipHealthCheck skips the WaitUntilReady call.
+	SkipHealthCheck bool
+
+	// ReadyTimeout overrides the default ready timeout.
+	ReadyTimeout time.Duration
+
+	// HealthCheckInterval overrides the default polling interval.
+	HealthCheckInterval time.Duration
+}
+
+// CodeInterpreter wraps a Sandbox with code execution capabilities.
+// It provides multi-language code execution with persistent contexts.
+type CodeInterpreter struct {
+	*Sandbox
+}
+
+// CreateCodeInterpreter creates a sandbox with the code-interpreter image
+// and returns a CodeInterpreter wrapping it.
+func CreateCodeInterpreter(ctx context.Context, config ConnectionConfig, opts CodeInterpreterCreateOptions) (*CodeInterpreter, error) {
+	image := opts.Image
+	if image == "" {
+		image = CodeInterpreterImage
+	}
+	entrypoint := opts.Entrypoint
+	if len(entrypoint) == 0 {
+		entrypoint = CodeInterpreterEntrypoint
+	}
+	timeout := opts.TimeoutSeconds
+	if timeout == nil {
+		t := DefaultCodeInterpreterTimeoutSeconds
+		timeout = &t
+	}
+
+	sb, err := CreateSandbox(ctx, config, SandboxCreateOptions{
+		Image:               image,
+		Entrypoint:          entrypoint,
+		ResourceLimits:      opts.ResourceLimits,
+		TimeoutSeconds:      timeout,
+		Env:                 opts.Env,
+		Metadata:            opts.Metadata,
+		SkipHealthCheck:     opts.SkipHealthCheck,
+		ReadyTimeout:        opts.ReadyTimeout,
+		HealthCheckInterval: opts.HealthCheckInterval,
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	return &CodeInterpreter{Sandbox: sb}, nil
+}
+
+// Execute runs code in the specified language and returns the structured result.
+// If contextID is empty, a new ephemeral context is used.
+func (ci *CodeInterpreter) Execute(ctx context.Context, language, code string, handlers *ExecutionHandlers) (*Execution, error) {
+	req := RunCodeRequest{
+		Code: code,
+	}
+	if language != "" {
+		req.Context = &CodeContext{Language: language}
+	}
+	return ci.ExecuteCode(ctx, req, handlers)
+}
+
+// ExecuteInContext runs code in an existing context (for state persistence).
+func (ci *CodeInterpreter) ExecuteInContext(ctx context.Context, contextID, language, code string, handlers *ExecutionHandlers) (*Execution, error) {
+	req := RunCodeRequest{
+		Context: &CodeContext{
+			ID:       contextID,
+			Language: language,
+		},
+		Code: code,
+	}
+	return ci.ExecuteCode(ctx, req, handlers)
+}
diff --git a/sdks/sandbox/go/opensandbox/config.go b/sdks/sandbox/go/opensandbox/config.go
new file mode 100644
index 00000000..359a422e
--- /dev/null
+++ b/sdks/sandbox/go/opensandbox/config.go
@@ -0,0 +1,149 @@
+package opensandbox
+
+import (
+	"fmt"
+	"net/http"
+	"os"
+	"strings"
+	"time"
+)
+
+// ConnectionConfig holds the configuration for connecting to an OpenSandbox server.
+type ConnectionConfig struct {
+	// Domain is the server address (e.g. "localhost:8080").
+	// Falls back to OPEN_SANDBOX_DOMAIN env var, then DefaultDomain.
+	Domain string
+
+	// Protocol is "http" or "https".
+	// Falls back to OPEN_SANDBOX_PROTOCOL env var, then DefaultProtocol.
+	Protocol string
+
+	// APIKey is the authentication token.
+	// Falls back to OPEN_SANDBOX_API_KEY env var.
+	APIKey string
+
+	// UseServerProxy routes execd/egress requests through the sandbox server
+	// instead of connecting directly to the sandbox endpoint.
+	UseServerProxy bool
+
+	// RequestTimeout is the timeout for non-streaming HTTP requests.
+	// Zero means no timeout. Defaults to DefaultRequestTimeout.
+	RequestTimeout time.Duration
+
+	// Headers are custom HTTP headers added to all requests.
+	Headers map[string]string
+
+	// HTTPClient is an optional custom HTTP client. If nil, a default is created.
+	HTTPClient *http.Client
+
+	// AuthHeader overrides the default lifecycle auth header name.
+	// Default is "OPEN-SANDBOX-API-KEY". Use "X-API-Key" for proxied deployments.
+	AuthHeader string
+}
+
+// GetDomain returns the configured domain, falling back to env var and default.
+func (c *ConnectionConfig) GetDomain() string {
+	if c.Domain != "" {
+		return c.Domain
+	}
+	if v := os.Getenv("OPEN_SANDBOX_DOMAIN"); v != "" {
+		return v
+	}
+	return DefaultDomain
+}
+
+// GetProtocol returns the configured protocol, falling back to env var and default.
+func (c *ConnectionConfig) GetProtocol() string {
+	if c.Protocol != "" {
+		return c.Protocol
+	}
+	if v := os.Getenv("OPEN_SANDBOX_PROTOCOL"); v != "" {
+		return v
+	}
+	return DefaultProtocol
+}
+
+// GetAPIKey returns the configured API key, falling back to env var.
+func (c *ConnectionConfig) GetAPIKey() string {
+	if c.APIKey != "" {
+		return c.APIKey
+	}
+	return os.Getenv("OPEN_SANDBOX_API_KEY")
+}
+
+// GetBaseURL returns the lifecycle API base URL (e.g. "http://localhost:8080").
+// Note: this does NOT append /v1. The lifecycle client's baseURL should be
+// set by the caller if a version prefix is needed (e.g. for local OpenSandbox
+// servers that require /v1). Staging/proxy deployments typically don't use /v1.
+func (c *ConnectionConfig) GetBaseURL() string {
+	domain := c.GetDomain()
+	protocol := c.GetProtocol()
+
+	// If domain already has a scheme, use it as-is.
+	if strings.HasPrefix(domain, "http://") || strings.HasPrefix(domain, "https://") {
+		return strings.TrimRight(domain, "/")
+	}
+
+	return fmt.Sprintf("%s://%s", protocol, domain)
+}
+
+// GetAuthHeader returns the auth header name for lifecycle requests.
+func (c *ConnectionConfig) GetAuthHeader() string {
+	if c.AuthHeader != "" {
+		return c.AuthHeader
+	}
+	return "OPEN-SANDBOX-API-KEY"
+}
+
+// GetRequestTimeout returns the request timeout, defaulting to DefaultRequestTimeout.
+func (c *ConnectionConfig) GetRequestTimeout() time.Duration {
+	if c.RequestTimeout > 0 {
+		return c.RequestTimeout
+	}
+	return DefaultRequestTimeout
+}
+
+// clientOpts builds the common Option slice from config fields.
+func (c *ConnectionConfig) clientOpts(includeAuthHeader bool) []Option {
+	var opts []Option
+	if includeAuthHeader && c.AuthHeader != "" {
+		opts = append(opts, WithAuthHeader(c.AuthHeader))
+	}
+	if c.HTTPClient != nil {
+		opts = append(opts, WithHTTPClient(c.HTTPClient))
+	}
+	if t := c.GetRequestTimeout(); t > 0 {
+		opts = append(opts, WithTimeout(t))
+	}
+	if len(c.Headers) > 0 {
+		opts = append(opts, WithHeaders(c.Headers))
+	}
+	return opts
+}
+
+// lifecycleClient creates a LifecycleClient from this config.
+// Appends the API version prefix (/v1) to the base URL, as required by
+// NewLifecycleClient and the OpenSandbox lifecycle API spec.
+func (c *ConnectionConfig) lifecycleClient() *LifecycleClient {
+	return NewLifecycleClient(c.GetBaseURL()+"/"+APIVersion, c.GetAPIKey(), c.clientOpts(true)...)
+}
+
+// execdClient creates an ExecdClient for a resolved endpoint.
+// endpointHeaders are additional headers from the endpoint resolution (e.g. routing headers).
+func (c *ConnectionConfig) execdClient(endpointURL, token string, endpointHeaders map[string]string) *ExecdClient {
+	opts := c.clientOpts(true)
+	if len(endpointHeaders) > 0 {
+		opts = append(opts, WithHeaders(endpointHeaders))
+	}
+	return NewExecdClient(endpointURL, token, opts...)
+}
+
+// egressClient creates an EgressClient for a resolved endpoint.
+// endpointHeaders are additional headers from the endpoint resolution (e.g. routing headers).
+func (c *ConnectionConfig) egressClient(endpointURL, token string, endpointHeaders map[string]string) *EgressClient {
+	opts := c.clientOpts(false)
+	if len(endpointHeaders) > 0 {
+		opts = append(opts, WithHeaders(endpointHeaders))
+	}
+	return NewEgressClient(endpointURL, token, opts...)
+}
diff --git a/sdks/sandbox/go/opensandbox/constants.go b/sdks/sandbox/go/opensandbox/constants.go
new file mode 100644
index 00000000..5229c74b
--- /dev/null
+++ b/sdks/sandbox/go/opensandbox/constants.go
@@ -0,0 +1,44 @@
+package opensandbox
+
+import "time"
+
+const (
+	// DefaultExecdPort is the standard port for the execd service inside a sandbox.
+	DefaultExecdPort = 44772
+
+	// DefaultEgressPort is the standard port for the egress sidecar inside a sandbox.
+	DefaultEgressPort = 18080
+
+	// DefaultTimeoutSeconds is the default sandbox TTL in seconds.
+	DefaultTimeoutSeconds = 600
+
+	// DefaultReadyTimeoutSeconds is the default timeout for WaitUntilReady.
+	DefaultReadyTimeoutSeconds = 30
+
+	// DefaultHealthCheckPollingInterval is the default polling interval for WaitUntilReady.
+	DefaultHealthCheckPollingInterval = 200 * time.Millisecond
+
+	// DefaultRequestTimeout is the default HTTP request timeout.
+	DefaultRequestTimeout = 30 * time.Second
+
+	// DefaultCodeInterpreterTimeoutSeconds is the default TTL for code interpreter sandboxes.
+	DefaultCodeInterpreterTimeoutSeconds = 900
+
+	// APIVersion is the lifecycle API version prefix.
+	APIVersion = "v1"
+
+	// DefaultDomain is the default OpenSandbox server address.
+	DefaultDomain = "localhost:8080"
+
+	// DefaultProtocol is the default protocol for connecting to the server.
+	DefaultProtocol = "http"
+)
+
+// DefaultEntrypoint keeps the sandbox alive for interactive use.
+var DefaultEntrypoint = []string{"tail", "-f", "/dev/null"}
+
+// DefaultResourceLimits provides sensible defaults for sandbox resource limits.
+var DefaultResourceLimits = ResourceLimits{
+	"cpu":    "1",
+	"memory": "2Gi",
+}
diff --git a/sdks/sandbox/go/opensandbox/egress.go b/sdks/sandbox/go/opensandbox/egress.go
new file mode 100644
index 00000000..6ed1f29e
--- /dev/null
+++ b/sdks/sandbox/go/opensandbox/egress.go
@@ -0,0 +1,40 @@
+package opensandbox
+
+import "context"
+
+// EgressClient provides methods for the OpenSandbox Egress API.
+// It connects to the egress sidecar endpoint running inside a specific sandbox.
+type EgressClient struct {
+	*Client
+}
+
+// NewEgressClient creates a new EgressClient.
+// baseURL is the sandbox-specific egress sidecar endpoint
+// (e.g. "http://localhost:18080").
+// authToken is the value for the OPENSANDBOX-EGRESS-AUTH header; pass ""
+// if the sidecar does not require authentication.
+func NewEgressClient(baseURL, authToken string, opts ...Option) *EgressClient {
+	return &EgressClient{
+		Client: NewClient(baseURL, authToken, "OPENSANDBOX-EGRESS-AUTH", opts...),
+	}
+}
+
+// GetPolicy returns the currently enforced egress policy and sidecar metadata.
+func (c *EgressClient) GetPolicy(ctx context.Context) (*PolicyStatusResponse, error) {
+	var resp PolicyStatusResponse
+	if err := c.doRequest(ctx, "GET", "/policy", nil, &resp); err != nil {
+		return nil, err
+	}
+	return &resp, nil
+}
+
+// PatchPolicy merges the given network rules into the current egress policy.
+// Existing rules remain unless overridden. For duplicate targets within the
+// same patch, the first rule wins.
+func (c *EgressClient) PatchPolicy(ctx context.Context, rules []NetworkRule) (*PolicyStatusResponse, error) {
+	var resp PolicyStatusResponse
+	if err := c.doRequest(ctx, "PATCH", "/policy", rules, &resp); err != nil {
+		return nil, err
+	}
+	return &resp, nil
+}
diff --git a/sdks/sandbox/go/opensandbox/errors.go b/sdks/sandbox/go/opensandbox/errors.go
new file mode 100644
index 00000000..4d50d86c
--- /dev/null
+++ b/sdks/sandbox/go/opensandbox/errors.go
@@ -0,0 +1,40 @@
+package opensandbox
+
+import "fmt"
+
+// SandboxReadyTimeoutError is returned when WaitUntilReady exceeds the deadline.
+type SandboxReadyTimeoutError struct {
+	SandboxID string
+	Elapsed   string
+	LastErr   error
+}
+
+func (e *SandboxReadyTimeoutError) Error() string {
+	msg := fmt.Sprintf("sandbox %s did not become ready within %s", e.SandboxID, e.Elapsed)
+	if e.LastErr != nil {
+		msg += fmt.Sprintf(": last error: %v", e.LastErr)
+	}
+	return msg
+}
+
+func (e *SandboxReadyTimeoutError) Unwrap() error { return e.LastErr }
+
+// SandboxUnhealthyError is returned when a sandbox is determined to be unhealthy.
+type SandboxUnhealthyError struct {
+	SandboxID string
+	Reason    string
+}
+
+func (e *SandboxUnhealthyError) Error() string {
+	return fmt.Sprintf("sandbox %s is unhealthy: %s", e.SandboxID, e.Reason)
+}
+
+// InvalidArgumentError is returned for invalid SDK arguments.
+type InvalidArgumentError struct {
+	Field   string
+	Message string
+}
+
+func (e *InvalidArgumentError) Error() string {
+	return fmt.Sprintf("invalid argument %q: %s", e.Field, e.Message)
+}
diff --git a/sdks/sandbox/go/opensandbox/execd.go b/sdks/sandbox/go/opensandbox/execd.go
new file mode 100644
index 00000000..a28868ac
--- /dev/null
+++ b/sdks/sandbox/go/opensandbox/execd.go
@@ -0,0 +1,393 @@
+package opensandbox
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"mime/multipart"
+	"net/http"
+	"net/textproto"
+	"net/url"
+	"os"
+	"path/filepath"
+	"strconv"
+)
+
+// ExecdClient provides access to the OpenSandbox Execd API for code execution,
+// command execution, file operations, and system metrics.
+type ExecdClient struct {
+	client *Client
+}
+
+// execdAuthHeader is the authentication header used by the Execd API.
+const execdAuthHeader = "X-EXECD-ACCESS-TOKEN"
+
+// NewExecdClient creates a new ExecdClient for the given base URL and access token.
+func NewExecdClient(baseURL, accessToken string, opts ...Option) *ExecdClient {
+	return &ExecdClient{
+		client: NewClient(baseURL, accessToken, execdAuthHeader, opts...),
+	}
+}
+
+// ---------------------------------------------------------------------------
+// Health
+// ---------------------------------------------------------------------------
+
+// Ping verifies that the Execd server is running and responsive.
+func (e *ExecdClient) Ping(ctx context.Context) error {
+	return e.client.doRequest(ctx, http.MethodGet, "/ping", nil, nil)
+}
+
+// ---------------------------------------------------------------------------
+// Code Execution
+// ---------------------------------------------------------------------------
+
+// ListContexts returns all active code execution contexts for the given language.
+func (e *ExecdClient) ListContexts(ctx context.Context, language string) ([]CodeContext, error) {
+	var result []CodeContext
+	path := "/code/contexts?language=" + url.QueryEscape(language)
+	err := e.client.doRequest(ctx, http.MethodGet, path, nil, &result)
+	return result, err
+}
+
+// CreateContext creates a new code execution context and returns it with a
+// session ID for subsequent code execution requests.
+func (e *ExecdClient) CreateContext(ctx context.Context, req CreateContextRequest) (*CodeContext, error) {
+	var result CodeContext
+	err := e.client.doRequest(ctx, http.MethodPost, "/code/context", req, &result)
+	if err != nil {
+		return nil, err
+	}
+	return &result, nil
+}
+
+// GetContext retrieves the details of an existing code execution context by ID.
+func (e *ExecdClient) GetContext(ctx context.Context, contextID string) (*CodeContext, error) {
+	var result CodeContext
+	path := "/code/contexts/" + url.PathEscape(contextID)
+	err := e.client.doRequest(ctx, http.MethodGet, path, nil, &result)
+	if err != nil {
+		return nil, err
+	}
+	return &result, nil
+}
+
+// DeleteContext deletes a code execution context by ID.
+func (e *ExecdClient) DeleteContext(ctx context.Context, contextID string) error {
+	path := "/code/contexts/" + url.PathEscape(contextID)
+	return e.client.doRequest(ctx, http.MethodDelete, path, nil, nil)
+}
+
+// DeleteContextsByLanguage deletes all code execution contexts for the given language.
+func (e *ExecdClient) DeleteContextsByLanguage(ctx context.Context, language string) error {
+	path := "/code/contexts?language=" + url.QueryEscape(language)
+	return e.client.doRequest(ctx, http.MethodDelete, path, nil, nil)
+}
+
+// ExecuteCode executes code in the specified context and streams output events
+// via SSE. The handler is called for each event received from the server.
+func (e *ExecdClient) ExecuteCode(ctx context.Context, req RunCodeRequest, handler EventHandler) error {
+	return e.client.doStreamRequest(ctx, http.MethodPost, "/code", req, handler)
+}
+
+// InterruptCode interrupts the currently running code execution.
+func (e *ExecdClient) InterruptCode(ctx context.Context, sessionID string) error {
+	path := "/code?id=" + url.QueryEscape(sessionID)
+	return e.client.doRequest(ctx, http.MethodDelete, path, nil, nil)
+}
+
+// ---------------------------------------------------------------------------
+// Command Execution
+// ---------------------------------------------------------------------------
+
+// CreateSession creates a new bash session and returns it with a session ID.
+func (e *ExecdClient) CreateSession(ctx context.Context) (*Session, error) {
+	var result Session
+	err := e.client.doRequest(ctx, http.MethodPost, "/session", struct{}{}, &result)
+	if err != nil {
+		return nil, err
+	}
+	return &result, nil
+}
+
+// RunInSession executes a command in an existing bash session and streams
+// output events via SSE.
+func (e *ExecdClient) RunInSession(ctx context.Context, sessionID string, req RunInSessionRequest, handler EventHandler) error {
+	path := "/session/" + url.PathEscape(sessionID) + "/run"
+	return e.client.doStreamRequest(ctx, http.MethodPost, path, req, handler)
+}
+
+// DeleteSession deletes a bash session by ID.
+func (e *ExecdClient) DeleteSession(ctx context.Context, sessionID string) error {
+	path := "/session/" + url.PathEscape(sessionID)
+	return e.client.doRequest(ctx, http.MethodDelete, path, nil, nil)
+}
+
+// RunCommand executes a shell command and streams output events via SSE.
+func (e *ExecdClient) RunCommand(ctx context.Context, req RunCommandRequest, handler EventHandler) error {
+	return e.client.doStreamRequest(ctx, http.MethodPost, "/command", req, handler)
+}
+
+// InterruptCommand interrupts the currently running command execution.
+func (e *ExecdClient) InterruptCommand(ctx context.Context, sessionID string) error {
+	path := "/command?id=" + url.QueryEscape(sessionID)
+	return e.client.doRequest(ctx, http.MethodDelete, path, nil, nil)
+}
+
+// GetCommandStatus returns the current status of a command by ID.
+func (e *ExecdClient) GetCommandStatus(ctx context.Context, commandID string) (*CommandStatusResponse, error) {
+	var result CommandStatusResponse
+	path := "/command/status/" + url.PathEscape(commandID)
+	err := e.client.doRequest(ctx, http.MethodGet, path, nil, &result)
+	if err != nil {
+		return nil, err
+	}
+	return &result, nil
+}
+
+// GetCommandLogs returns stdout/stderr for a background command. Pass cursor=-1
+// or cursor=0 for the full log. The returned CommandLogsResponse includes the
+// tail cursor for incremental polling.
+func (e *ExecdClient) GetCommandLogs(ctx context.Context, commandID string, cursor *int64) (*CommandLogsResponse, error) {
+	path := "/command/" + url.PathEscape(commandID) + "/logs"
+	if cursor != nil {
+		path += "?cursor=" + strconv.FormatInt(*cursor, 10)
+	}
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, e.client.baseURL+path, nil)
+	if err != nil {
+		return nil, fmt.Errorf("opensandbox: create request: %w", err)
+	}
+	if e.client.apiKey != "" {
+		req.Header.Set(e.client.authHeader, e.client.apiKey)
+	}
+	req.Header.Set("Accept", "text/plain")
+
+	resp, err := e.client.httpClient.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("opensandbox: do request: %w", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode >= 400 {
+		return nil, handleError(resp)
+	}
+
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return nil, fmt.Errorf("opensandbox: read response: %w", err)
+	}
+
+	result := &CommandLogsResponse{
+		Output: string(body),
+	}
+
+	if cursorStr := resp.Header.Get("EXECD-COMMANDS-TAIL-CURSOR"); cursorStr != "" {
+		parsed, parseErr := strconv.ParseInt(cursorStr, 10, 64)
+		if parseErr != nil {
+			return nil, fmt.Errorf("opensandbox: invalid EXECD-COMMANDS-TAIL-CURSOR header %q: %w", cursorStr, parseErr)
+		}
+		result.Cursor = parsed
+	}
+
+	return result, nil
+}
+
+// ---------------------------------------------------------------------------
+// File Operations
+// ---------------------------------------------------------------------------
+
+// GetFileInfo retrieves metadata for the file at the given path.
+func (e *ExecdClient) GetFileInfo(ctx context.Context, path string) (map[string]FileInfo, error) {
+	var result map[string]FileInfo
+	reqPath := "/files/info?path=" + url.QueryEscape(path)
+	err := e.client.doRequest(ctx, http.MethodGet, reqPath, nil, &result)
+	return result, err
+}
+
+// DeleteFiles deletes one or more files from the sandbox.
+func (e *ExecdClient) DeleteFiles(ctx context.Context, paths []string) error {
+	params := url.Values{}
+	for _, p := range paths {
+		params.Add("path", p)
+	}
+	reqPath := "/files?" + params.Encode()
+	return e.client.doRequest(ctx, http.MethodDelete, reqPath, nil, nil)
+}
+
+// SetPermissions changes permissions, owner, and group for the specified files.
+func (e *ExecdClient) SetPermissions(ctx context.Context, req PermissionsRequest) error {
+	return e.client.doRequest(ctx, http.MethodPost, "/files/permissions", req, nil)
+}
+
+// MoveFiles renames or moves files to new paths.
+func (e *ExecdClient) MoveFiles(ctx context.Context, req MoveRequest) error {
+	return e.client.doRequest(ctx, http.MethodPost, "/files/mv", req, nil)
+}
+
+// SearchFiles searches for files matching a glob pattern within a directory.
+func (e *ExecdClient) SearchFiles(ctx context.Context, dir string, pattern string) ([]FileInfo, error) {
+	var result []FileInfo
+	params := url.Values{}
+	params.Set("path", dir)
+	if pattern != "" {
+		params.Set("pattern", pattern)
+	}
+	reqPath := "/files/search?" + params.Encode()
+	err := e.client.doRequest(ctx, http.MethodGet, reqPath, nil, &result)
+	return result, err
+}
+
+// ReplaceInFiles performs text replacement in the specified files.
+func (e *ExecdClient) ReplaceInFiles(ctx context.Context, req ReplaceRequest) error {
+	return e.client.doRequest(ctx, http.MethodPost, "/files/replace", req, nil)
+}
+
+// UploadFile uploads a local file to the sandbox at the specified remote path.
+// The file is sent as a multipart form with metadata and file content parts.
+func (e *ExecdClient) UploadFile(ctx context.Context, localPath, remotePath string) error {
+	f, err := os.Open(localPath)
+	if err != nil {
+		return fmt.Errorf("opensandbox: open file: %w", err)
+	}
+	defer f.Close()
+
+	var body bytes.Buffer
+	writer := multipart.NewWriter(&body)
+
+	// Write metadata part.
+	meta := FileMetadata{Path: remotePath}
+	metaJSON, err := json.Marshal(meta)
+	if err != nil {
+		return fmt.Errorf("opensandbox: marshal metadata: %w", err)
+	}
+
+	metaHeader := make(textproto.MIMEHeader)
+	metaHeader.Set("Content-Disposition", `form-data; name="metadata"`)
+	metaHeader.Set("Content-Type", "application/json")
+	metaPart, err := writer.CreatePart(metaHeader)
+	if err != nil {
+		return fmt.Errorf("opensandbox: create metadata part: %w", err)
+	}
+	if _, err := metaPart.Write(metaJSON); err != nil {
+		return fmt.Errorf("opensandbox: write metadata: %w", err)
+	}
+
+	// Write file part.
+	filePart, err := writer.CreateFormFile("file", filepath.Base(localPath))
+	if err != nil {
+		return fmt.Errorf("opensandbox: create file part: %w", err)
+	}
+	if _, err := io.Copy(filePart, f); err != nil {
+		return fmt.Errorf("opensandbox: write file: %w", err)
+	}
+
+	if err := writer.Close(); err != nil {
+		return fmt.Errorf("opensandbox: close multipart: %w", err)
+	}
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, e.client.baseURL+"/files/upload", &body)
+	if err != nil {
+		return fmt.Errorf("opensandbox: create request: %w", err)
+	}
+	if e.client.apiKey != "" {
+		req.Header.Set(e.client.authHeader, e.client.apiKey)
+	}
+	req.Header.Set("Content-Type", writer.FormDataContentType())
+
+	resp, err := e.client.httpClient.Do(req)
+	if err != nil {
+		return fmt.Errorf("opensandbox: do request: %w", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode >= 400 {
+		return handleError(resp)
+	}
+	return nil
+}
+
+// DownloadFile downloads a file from the sandbox. The caller must close the
+// returned io.ReadCloser. Pass rangeHeader (e.g. "bytes=0-1023") for partial
+// content, or empty string for the full file.
+func (e *ExecdClient) DownloadFile(ctx context.Context, remotePath string, rangeHeader string) (io.ReadCloser, error) {
+	reqPath := "/files/download?path=" + url.QueryEscape(remotePath)
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, e.client.baseURL+reqPath, nil)
+	if err != nil {
+		return nil, fmt.Errorf("opensandbox: create request: %w", err)
+	}
+	if e.client.apiKey != "" {
+		req.Header.Set(e.client.authHeader, e.client.apiKey)
+	}
+	if rangeHeader != "" {
+		req.Header.Set("Range", rangeHeader)
+	}
+
+	resp, err := e.client.httpClient.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("opensandbox: do request: %w", err)
+	}
+
+	if resp.StatusCode >= 400 {
+		defer resp.Body.Close()
+		return nil, handleError(resp)
+	}
+
+	return resp.Body, nil
+}
+
+// ---------------------------------------------------------------------------
+// Directory Operations
+// ---------------------------------------------------------------------------
+
+// CreateDirectory creates a directory at the given path with the specified mode.
+// Parent directories are created as needed (like mkdir -p).
+// Mode is specified as octal digits in decimal form (e.g. 755 for rwxr-xr-x).
+// Use OctalMode() to convert Go os.FileMode to the expected format.
+func (e *ExecdClient) CreateDirectory(ctx context.Context, path string, mode int) error {
+	body := map[string]map[string]int{
+		path: {"mode": mode},
+	}
+	return e.client.doRequest(ctx, http.MethodPost, "/directories", body, nil)
+}
+
+// OctalMode converts a Go os.FileMode to the octal-digits-as-int format
+// expected by the OpenSandbox server (e.g. os.FileMode(0755) → 755).
+// Panics if the conversion fails (should never happen for valid FileMode values).
+func OctalMode(m os.FileMode) int {
+	v, err := strconv.Atoi(fmt.Sprintf("%o", m))
+	if err != nil {
+		panic(fmt.Sprintf("opensandbox: invalid FileMode %v: %v", m, err))
+	}
+	return v
+}
+
+// DeleteDirectory deletes a directory and all its contents recursively.
+func (e *ExecdClient) DeleteDirectory(ctx context.Context, path string) error {
+	reqPath := "/directories?path=" + url.QueryEscape(path)
+	return e.client.doRequest(ctx, http.MethodDelete, reqPath, nil, nil)
+}
+
+// ---------------------------------------------------------------------------
+// Metrics
+// ---------------------------------------------------------------------------
+
+// GetMetrics retrieves current system resource metrics.
+func (e *ExecdClient) GetMetrics(ctx context.Context) (*Metrics, error) {
+	var result Metrics
+	err := e.client.doRequest(ctx, http.MethodGet, "/metrics", nil, &result)
+	if err != nil {
+		return nil, err
+	}
+	return &result, nil
+}
+
+// WatchMetrics streams system metrics in real-time via SSE. The handler
+// receives a new event approximately every second until the context is
+// cancelled or an error occurs.
+func (e *ExecdClient) WatchMetrics(ctx context.Context, handler EventHandler) error {
+	return e.client.doStreamRequest(ctx, http.MethodGet, "/metrics/watch", nil, handler)
+}
diff --git a/sdks/sandbox/go/opensandbox/execution.go b/sdks/sandbox/go/opensandbox/execution.go
new file mode 100644
index 00000000..5be12bca
--- /dev/null
+++ b/sdks/sandbox/go/opensandbox/execution.go
@@ -0,0 +1,236 @@
+package opensandbox
+
+import (
+	"encoding/json"
+	"strconv"
+	"strings"
+)
+
+// OutputMessage represents a single stdout or stderr line from command execution.
+type OutputMessage struct {
+	Text      string `json:"text"`
+	Timestamp int64  `json:"timestamp"`
+}
+
+// ExecutionResult represents a result output from code execution.
+// Results maps MIME types to their string representations (e.g. "text/plain" → "4").
+type ExecutionResult struct {
+	// Results holds MIME-type keyed outputs (e.g. "text/plain", "text/html").
+	Results   map[string]string `json:"results,omitempty"`
+	Timestamp int64             `json:"timestamp"`
+}
+
+// Text returns the text/plain result, or empty string if not present.
+func (r ExecutionResult) Text() string {
+	return r.Results["text/plain"]
+}
+
+// ExecutionError represents an error during code/command execution.
+type ExecutionError struct {
+	Name      string   `json:"name"`
+	Value     string   `json:"value"`
+	Timestamp int64    `json:"timestamp"`
+	Traceback []string `json:"traceback"`
+}
+
+// ExecutionComplete represents the completion event from the server.
+type ExecutionComplete struct {
+	Timestamp     int64 `json:"timestamp"`
+	ExecutionTime int64 `json:"execution_time"`
+}
+
+// ExecutionInit represents the initialization event from the server.
+type ExecutionInit struct {
+	ID        string `json:"text"`
+	Timestamp int64  `json:"timestamp"`
+}
+
+// Execution is the structured result of a command or code execution.
+type Execution struct {
+	// ID is the execution/command identifier from the init event.
+	ID string
+
+	// Stdout contains all stdout messages in order.
+	Stdout []OutputMessage
+
+	// Stderr contains all stderr messages in order.
+	Stderr []OutputMessage
+
+	// Results contains execution results (for code interpreter).
+	Results []ExecutionResult
+
+	// Error is set if the execution failed.
+	Error *ExecutionError
+
+	// Complete is set when execution finishes.
+	Complete *ExecutionComplete
+
+	// ExitCode is the process exit code. Nil if not available.
+	ExitCode *int
+}
+
+// Text returns the combined stdout text.
+func (e *Execution) Text() string {
+	var b strings.Builder
+	for i, m := range e.Stdout {
+		if i > 0 {
+			b.WriteByte('\n')
+		}
+		b.WriteString(m.Text)
+	}
+	return b.String()
+}
+
+// ExecutionHandlers provides optional callbacks invoked during streaming execution.
+// Return a non-nil error from any handler to abort the stream.
+type ExecutionHandlers struct {
+	OnInit     func(ExecutionInit) error
+	OnStdout   func(OutputMessage) error
+	OnStderr   func(OutputMessage) error
+	OnResult   func(ExecutionResult) error
+	OnComplete func(ExecutionComplete) error
+	OnError    func(ExecutionError) error
+}
+
+// sseErrorPayload is the nested error object in a ServerStreamEvent.
+type sseErrorPayload struct {
+	EName     string   `json:"ename,omitempty"`
+	EValue    string   `json:"evalue,omitempty"`
+	Traceback []string `json:"traceback,omitempty"`
+}
+
+// sseEvent is the raw JSON structure from execd SSE/NDJSON events.
+// Supports both the spec format (nested error/results objects) and the
+// legacy flat format (top-level ename/evalue/traceback) for backward compat.
+type sseEvent struct {
+	Type          string `json:"type"`
+	Text          string `json:"text"`
+	Timestamp     int64  `json:"timestamp"`
+	ExitCode      *int   `json:"exit_code,omitempty"`
+	ExecutionTime int64  `json:"execution_time,omitempty"`
+
+	// Nested error object (spec: {"type":"error","error":{...}})
+	Error *sseErrorPayload `json:"error,omitempty"`
+	// Nested results object (spec: {"type":"result","results":{"text/plain":"..."}})
+	Results map[string]string `json:"results,omitempty"`
+
+	// Flat error fields kept for backward compatibility with older servers
+	EName     string   `json:"ename,omitempty"`
+	EValue    string   `json:"evalue,omitempty"`
+	Traceback []string `json:"traceback,omitempty"`
+}
+
+// processStreamEvent parses a raw StreamEvent into the Execution accumulator
+// and invokes the appropriate handler.
+func processStreamEvent(exec *Execution, event StreamEvent, handlers *ExecutionHandlers) error {
+	data := event.Data
+	if data == "" {
+		return nil
+	}
+
+	var ev sseEvent
+	if err := json.Unmarshal([]byte(data), &ev); err != nil {
+		// Not JSON — treat as raw stdout
+		msg := OutputMessage{Text: data}
+		exec.Stdout = append(exec.Stdout, msg)
+		if handlers != nil && handlers.OnStdout != nil {
+			return handlers.OnStdout(msg)
+		}
+		return nil
+	}
+
+	switch ev.Type {
+	case "init":
+		initEvent := ExecutionInit{ID: ev.Text, Timestamp: ev.Timestamp}
+		exec.ID = ev.Text
+		if handlers != nil && handlers.OnInit != nil {
+			return handlers.OnInit(initEvent)
+		}
+
+	case "stdout":
+		msg := OutputMessage{Text: ev.Text, Timestamp: ev.Timestamp}
+		exec.Stdout = append(exec.Stdout, msg)
+		if handlers != nil && handlers.OnStdout != nil {
+			return handlers.OnStdout(msg)
+		}
+
+	case "stderr":
+		msg := OutputMessage{Text: ev.Text, Timestamp: ev.Timestamp}
+		exec.Stderr = append(exec.Stderr, msg)
+		if handlers != nil && handlers.OnStderr != nil {
+			return handlers.OnStderr(msg)
+		}
+
+	case "result":
+		res := ExecutionResult{Timestamp: ev.Timestamp}
+		if ev.Results != nil {
+			// Spec format: MIME-keyed map under "results"
+			res.Results = ev.Results
+		} else if ev.Text != "" {
+			// Legacy flat format: bare "text" field
+			res.Results = map[string]string{"text/plain": ev.Text}
+		}
+		exec.Results = append(exec.Results, res)
+		if handlers != nil && handlers.OnResult != nil {
+			return handlers.OnResult(res)
+		}
+
+	case "error":
+		var ename, evalue string
+		var traceback []string
+		// Prefer nested error object per spec; fall back to flat fields
+		if ev.Error != nil {
+			ename = ev.Error.EName
+			evalue = ev.Error.EValue
+			traceback = ev.Error.Traceback
+		} else {
+			ename = ev.EName
+			evalue = ev.EValue
+			traceback = ev.Traceback
+		}
+		execErr := ExecutionError{
+			Name:      ename,
+			Value:     evalue,
+			Timestamp: ev.Timestamp,
+			Traceback: traceback,
+		}
+		exec.Error = &execErr
+		// Try to parse exit code from error value
+		if code, err := strconv.Atoi(evalue); err == nil {
+			exec.ExitCode = &code
+		}
+		if handlers != nil && handlers.OnError != nil {
+			return handlers.OnError(execErr)
+		}
+
+	case "execution_complete":
+		complete := ExecutionComplete{
+			Timestamp:     ev.Timestamp,
+			ExecutionTime: ev.ExecutionTime,
+		}
+		exec.Complete = &complete
+		// Foreground command exit code: 0 if no error
+		if exec.ExitCode == nil && exec.Error == nil {
+			zero := 0
+			exec.ExitCode = &zero
+		}
+		if handlers != nil && handlers.OnComplete != nil {
+			return handlers.OnComplete(complete)
+		}
+
+	case "ping":
+		// Ignore ping events
+
+	default:
+		// Unknown event type — treat as stdout
+		if ev.Text != "" {
+			msg := OutputMessage{Text: ev.Text, Timestamp: ev.Timestamp}
+			exec.Stdout = append(exec.Stdout, msg)
+			if handlers != nil && handlers.OnStdout != nil {
+				return handlers.OnStdout(msg)
+			}
+		}
+	}
+
+	return nil
+}
diff --git a/sdks/sandbox/go/opensandbox/http.go b/sdks/sandbox/go/opensandbox/http.go
new file mode 100644
index 00000000..94e606e4
--- /dev/null
+++ b/sdks/sandbox/go/opensandbox/http.go
@@ -0,0 +1,159 @@
+package opensandbox
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"time"
+)
+
+// defaultTimeout is 0 (no global timeout) because a non-zero value kills
+// long-lived SSE streaming connections. Use per-request context deadlines
+// instead to control individual call timeouts.
+const defaultTimeout = 0
+
+// Client is the base HTTP client shared by LifecycleClient and EgressClient.
+type Client struct {
+	baseURL    string
+	apiKey     string
+	authHeader string
+	httpClient *http.Client
+	timeout    *time.Duration // stored separately, applied after all options
+	headers    map[string]string
+}
+
+// Option configures a Client.
+type Option func(*Client)
+
+// WithHTTPClient sets a custom http.Client.
+func WithHTTPClient(c *http.Client) Option {
+	return func(cl *Client) {
+		cl.httpClient = c
+	}
+}
+
+// WithTimeout sets the HTTP client timeout. The timeout is applied after all
+// options, so it is safe to combine with WithHTTPClient in any order.
+func WithTimeout(d time.Duration) Option {
+	return func(cl *Client) {
+		cl.timeout = &d
+	}
+}
+
+// WithHeaders adds custom HTTP headers to all requests. These are applied
+// before the auth and content-type headers, so they cannot override those.
+func WithHeaders(headers map[string]string) Option {
+	return func(cl *Client) {
+		if cl.headers == nil {
+			cl.headers = make(map[string]string, len(headers))
+		}
+		for k, v := range headers {
+			cl.headers[k] = v
+		}
+	}
+}
+
+// WithAuthHeader overrides the default auth header name. Use this when the
+// server expects a different header (e.g. "X-API-Key" instead of
+// "OPEN-SANDBOX-API-KEY").
+func WithAuthHeader(header string) Option {
+	return func(cl *Client) {
+		cl.authHeader = header
+	}
+}
+
+// NewClient creates a new base Client. The authHeader parameter specifies
+// which HTTP header carries the API key (e.g. "OPEN-SANDBOX-API-KEY" for
+// lifecycle, "OPENSANDBOX-EGRESS-AUTH" for egress).
+func NewClient(baseURL, apiKey, authHeader string, opts ...Option) *Client {
+	c := &Client{
+		baseURL:    baseURL,
+		apiKey:     apiKey,
+		authHeader: authHeader,
+		httpClient: &http.Client{Timeout: defaultTimeout},
+	}
+	for _, opt := range opts {
+		opt(c)
+	}
+	// Apply deferred timeout after all options so it works regardless of
+	// WithHTTPClient ordering and guards against a nil httpClient.
+	if c.timeout != nil {
+		if c.httpClient == nil {
+			c.httpClient = &http.Client{}
+		}
+		c.httpClient.Timeout = *c.timeout
+	}
+	return c
+}
+
+// doRequest executes an HTTP request with JSON encoding and auth headers.
+// If body is nil, no request body is sent. If result is non-nil, the
+// response body is decoded into it.
+func (c *Client) doRequest(ctx context.Context, method, path string, body any, result any) error {
+	var bodyReader io.Reader
+	if body != nil {
+		buf, err := json.Marshal(body)
+		if err != nil {
+			return fmt.Errorf("opensandbox: marshal request: %w", err)
+		}
+		bodyReader = bytes.NewReader(buf)
+	}
+
+	req, err := http.NewRequestWithContext(ctx, method, c.baseURL+path, bodyReader)
+	if err != nil {
+		return fmt.Errorf("opensandbox: create request: %w", err)
+	}
+
+	for k, v := range c.headers {
+		req.Header.Set(k, v)
+	}
+	if c.apiKey != "" {
+		req.Header.Set(c.authHeader, c.apiKey)
+	}
+	if body != nil {
+		req.Header.Set("Content-Type", "application/json")
+	}
+	req.Header.Set("Accept", "application/json")
+
+	resp, err := c.httpClient.Do(req)
+	if err != nil {
+		return fmt.Errorf("opensandbox: do request: %w", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode >= 400 {
+		return handleError(resp)
+	}
+
+	// No content (e.g. 204)
+	if resp.StatusCode == http.StatusNoContent || result == nil {
+		return nil
+	}
+
+	if err := json.NewDecoder(resp.Body).Decode(result); err != nil {
+		return fmt.Errorf("opensandbox: decode response: %w", err)
+	}
+	return nil
+}
+
+// handleError reads the response body and returns an *APIError.
+func handleError(resp *http.Response) error {
+	data, _ := io.ReadAll(resp.Body)
+
+	apiErr := &APIError{
+		StatusCode: resp.StatusCode,
+		RequestID:  resp.Header.Get("X-Request-Id"),
+	}
+
+	// Try to decode as JSON ErrorResponse; fall back to raw body.
+	if err := json.Unmarshal(data, &apiErr.Response); err != nil || apiErr.Response.Code == "" {
+		apiErr.Response = ErrorResponse{
+			Code:    http.StatusText(resp.StatusCode),
+			Message: string(data),
+		}
+	}
+	return apiErr
+}
diff --git a/sdks/sandbox/go/opensandbox/integration_test.go b/sdks/sandbox/go/opensandbox/integration_test.go
new file mode 100644
index 00000000..51ddffbb
--- /dev/null
+++ b/sdks/sandbox/go/opensandbox/integration_test.go
@@ -0,0 +1,204 @@
+//go:build integration
+
+package opensandbox_test
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/alibaba/OpenSandbox/sdks/sandbox/go/opensandbox"
+)
+
+func getServerURL() string {
+	if u := os.Getenv("OPENSANDBOX_URL"); u != "" {
+		return u
+	}
+	return "http://localhost:8090"
+}
+
+func TestIntegration_FullLifecycle(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Minute)
+	defer cancel()
+
+	client := opensandbox.NewLifecycleClient(getServerURL()+"/v1", "test-key")
+
+	// 1. List sandboxes
+	list, err := client.ListSandboxes(ctx, opensandbox.ListOptions{Page: 1, PageSize: 10})
+	if err != nil {
+		t.Fatalf("ListSandboxes: %v", err)
+	}
+	t.Logf("Initial sandbox count: %d", list.Pagination.TotalItems)
+
+	// 2. Create a sandbox
+	sb, err := client.CreateSandbox(ctx, opensandbox.CreateSandboxRequest{
+		Image: opensandbox.ImageSpec{
+			URI: "python:3.11-slim",
+		},
+		Entrypoint: []string{"tail", "-f", "/dev/null"},
+		ResourceLimits: map[string]string{
+			"cpu":    "500m",
+			"memory": "256Mi",
+		},
+		Metadata: map[string]string{
+			"test": "integration",
+		},
+	})
+	if err != nil {
+		t.Fatalf("CreateSandbox: %v", err)
+	}
+	t.Logf("Created sandbox: %s (state: %s)", sb.ID, sb.Status.State)
+
+	if sb.ID == "" {
+		t.Fatal("Sandbox ID is empty")
+	}
+
+	defer func() {
+		t.Log("Cleaning up: deleting sandbox")
+		_ = client.DeleteSandbox(context.Background(), sb.ID)
+	}()
+
+	// 3. Wait for Running state
+	var running *opensandbox.SandboxInfo
+	for i := 0; i < 30; i++ {
+		running, err = client.GetSandbox(ctx, sb.ID)
+		if err != nil {
+			t.Fatalf("GetSandbox: %v", err)
+		}
+		t.Logf("  Poll %d: state=%s", i+1, running.Status.State)
+		if running.Status.State == opensandbox.StateRunning {
+			break
+		}
+		if running.Status.State == opensandbox.StateFailed || running.Status.State == opensandbox.StateTerminated {
+			t.Fatalf("Sandbox entered terminal state: %s (reason: %s, message: %s)",
+				running.Status.State, running.Status.Reason, running.Status.Message)
+		}
+		time.Sleep(2 * time.Second)
+	}
+
+	if running == nil || running.Status.State != opensandbox.StateRunning {
+		t.Fatal("Sandbox did not reach Running state within timeout")
+	}
+	t.Logf("Sandbox is Running: %s", running.ID)
+
+	// 4. Get execd endpoint (default execd port: 44772)
+	endpoint, err := client.GetEndpoint(ctx, sb.ID, 44772, nil)
+	if err != nil {
+		t.Fatalf("GetEndpoint(44772): %v", err)
+	}
+	t.Logf("Execd endpoint: %s", endpoint.Endpoint)
+
+	if endpoint.Endpoint == "" {
+		t.Fatal("Execd endpoint is empty")
+	}
+
+	// 5. Test Execd — ping
+	// Normalize endpoint URL: add scheme if missing, replace host.docker.internal with localhost
+	execdURL := endpoint.Endpoint
+	if !strings.HasPrefix(execdURL, "http") {
+		execdURL = "http://" + execdURL
+	}
+	execdURL = strings.Replace(execdURL, "host.docker.internal", "localhost", 1)
+	t.Logf("Normalized execd URL: %s", execdURL)
+
+	execToken := ""
+	if endpoint.Headers != nil {
+		execToken = endpoint.Headers["X-EXECD-ACCESS-TOKEN"]
+	}
+	execClient := opensandbox.NewExecdClient(execdURL, execToken)
+
+	err = execClient.Ping(ctx)
+	if err != nil {
+		t.Fatalf("Execd Ping: %v", err)
+	}
+	t.Log("Execd ping: OK")
+
+	// 6. Test Execd — run a command with SSE streaming
+	var output strings.Builder
+	err = execClient.RunCommand(ctx, opensandbox.RunCommandRequest{
+		Command: "echo hello-from-opensandbox && python3 --version",
+	}, func(event opensandbox.StreamEvent) error {
+		t.Logf("  SSE event: type=%s data=%s", event.Event, event.Data)
+		output.WriteString(event.Data)
+		return nil
+	})
+	if err != nil {
+		t.Fatalf("RunCommand: %v", err)
+	}
+
+	// Note: SSE events may carry output as JSON in the Data field.
+	// The handler above concatenates raw Data; if empty, events were received but
+	// output is in a structured format (e.g., {"output":"..."}).
+	t.Logf("Command raw output (%d bytes): %q", output.Len(), output.String())
+
+	// 7. Test Execd — file operations
+	fileInfoMap, err := execClient.GetFileInfo(ctx, "/etc/os-release")
+	if err != nil {
+		t.Fatalf("GetFileInfo: %v", err)
+	}
+	for path, fi := range fileInfoMap {
+		t.Logf("File info: path=%s size=%d", path, fi.Size)
+	}
+
+	// 8. Test Execd — metrics
+	metrics, err := execClient.GetMetrics(ctx)
+	if err != nil {
+		t.Fatalf("GetMetrics: %v", err)
+	}
+	t.Logf("Metrics: cpu_count=%.0f mem_total=%.0fMiB", metrics.CPUCount, metrics.MemTotalMB)
+
+	// 9. Test Egress — get policy (if available, default egress port: 18080)
+	egressEndpoint, err := client.GetEndpoint(ctx, sb.ID, 18080, nil)
+	if err != nil {
+		t.Logf("GetEndpoint(egress): %v (skipping egress tests)", err)
+	} else {
+		egressURL := egressEndpoint.Endpoint
+		if !strings.HasPrefix(egressURL, "http") {
+			egressURL = "http://" + egressURL
+		}
+		egressURL = strings.Replace(egressURL, "host.docker.internal", "localhost", 1)
+
+		egressToken := ""
+		if egressEndpoint.Headers != nil {
+			egressToken = egressEndpoint.Headers["OPENSANDBOX-EGRESS-AUTH"]
+		}
+		egressClient := opensandbox.NewEgressClient(egressURL, egressToken)
+
+		policy, err := egressClient.GetPolicy(ctx)
+		if err != nil {
+			t.Logf("GetPolicy: %v (egress sidecar might not be ready)", err)
+		} else {
+			t.Logf("Egress policy: mode=%s defaultAction=%s rules=%d",
+				policy.Mode, policy.Policy.DefaultAction, len(policy.Policy.Egress))
+		}
+	}
+
+	// 10. Renew expiration
+	_, err = client.RenewExpiration(ctx, sb.ID, time.Now().Add(30*time.Minute))
+	if err != nil {
+		t.Logf("RenewExpiration: %v (might not be supported)", err)
+	} else {
+		t.Log("Renewed expiration: +30m")
+	}
+
+	// 11. Delete sandbox
+	err = client.DeleteSandbox(ctx, sb.ID)
+	if err != nil {
+		t.Fatalf("DeleteSandbox: %v", err)
+	}
+	t.Log("Sandbox deleted successfully")
+
+	// 12. Verify deletion — should get error or terminal state
+	deleted, err := client.GetSandbox(ctx, sb.ID)
+	if err != nil {
+		t.Logf("GetSandbox after delete: %v (expected)", err)
+	} else {
+		t.Logf("GetSandbox after delete: state=%s", deleted.Status.State)
+	}
+
+	fmt.Println("\n=== INTEGRATION TEST PASSED ===")
+	fmt.Println("Lifecycle: create → poll → Running → execd ping → run command (SSE) → file info → metrics → egress → renew → delete")
+}
diff --git a/sdks/sandbox/go/opensandbox/lifecycle.go b/sdks/sandbox/go/opensandbox/lifecycle.go
new file mode 100644
index 00000000..dbd10f13
--- /dev/null
+++ b/sdks/sandbox/go/opensandbox/lifecycle.go
@@ -0,0 +1,131 @@
+package opensandbox
+
+import (
+	"context"
+	"fmt"
+	"net/url"
+	"strconv"
+	"time"
+)
+
+// LifecycleClient provides methods for the OpenSandbox Lifecycle API.
+type LifecycleClient struct {
+	*Client
+}
+
+// NewLifecycleClient creates a new LifecycleClient.
+// baseURL should include the version prefix (e.g. "http://localhost:8080/v1").
+func NewLifecycleClient(baseURL, apiKey string, opts ...Option) *LifecycleClient {
+	return &LifecycleClient{
+		Client: NewClient(baseURL, apiKey, "OPEN-SANDBOX-API-KEY", opts...),
+	}
+}
+
+// ListOptions configures filtering and pagination for ListSandboxes.
+type ListOptions struct {
+	// States filters by lifecycle state. Multiple values use OR logic.
+	States []SandboxState
+	// Metadata filters by key-value metadata (AND logic).
+	Metadata map[string]string
+	// Page number (1-based). Defaults to 1.
+	Page int
+	// PageSize is the number of items per page. Defaults to 20.
+	PageSize int
+}
+
+// ListSandboxes returns a paginated list of sandboxes with optional filtering.
+func (c *LifecycleClient) ListSandboxes(ctx context.Context, opts ListOptions) (*ListSandboxesResponse, error) {
+	params := url.Values{}
+	for _, s := range opts.States {
+		params.Add("state", string(s))
+	}
+	if len(opts.Metadata) > 0 {
+		metaVals := url.Values{}
+		for k, v := range opts.Metadata {
+			metaVals.Set(k, v)
+		}
+		params.Set("metadata", metaVals.Encode())
+	}
+	if opts.Page > 0 {
+		params.Set("page", strconv.Itoa(opts.Page))
+	}
+	if opts.PageSize > 0 {
+		params.Set("pageSize", strconv.Itoa(opts.PageSize))
+	}
+
+	path := "/sandboxes"
+	if encoded := params.Encode(); encoded != "" {
+		path += "?" + encoded
+	}
+
+	var resp ListSandboxesResponse
+	if err := c.doRequest(ctx, "GET", path, nil, &resp); err != nil {
+		return nil, err
+	}
+	return &resp, nil
+}
+
+// CreateSandbox creates a new sandbox from a container image.
+func (c *LifecycleClient) CreateSandbox(ctx context.Context, req CreateSandboxRequest) (*SandboxInfo, error) {
+	var resp SandboxInfo
+	if err := c.doRequest(ctx, "POST", "/sandboxes", req, &resp); err != nil {
+		return nil, err
+	}
+	return &resp, nil
+}
+
+// GetSandbox retrieves the complete sandbox information by ID.
+func (c *LifecycleClient) GetSandbox(ctx context.Context, id string) (*SandboxInfo, error) {
+	var resp SandboxInfo
+	if err := c.doRequest(ctx, "GET", "/sandboxes/"+url.PathEscape(id), nil, &resp); err != nil {
+		return nil, err
+	}
+	return &resp, nil
+}
+
+// DeleteSandbox deletes a sandbox, scheduling it for termination.
+func (c *LifecycleClient) DeleteSandbox(ctx context.Context, id string) error {
+	return c.doRequest(ctx, "DELETE", "/sandboxes/"+url.PathEscape(id), nil, nil)
+}
+
+// PauseSandbox pauses a running sandbox while preserving its state.
+func (c *LifecycleClient) PauseSandbox(ctx context.Context, id string) error {
+	return c.doRequest(ctx, "POST", "/sandboxes/"+url.PathEscape(id)+"/pause", nil, nil)
+}
+
+// ResumeSandbox resumes a paused sandbox.
+func (c *LifecycleClient) ResumeSandbox(ctx context.Context, id string) error {
+	return c.doRequest(ctx, "POST", "/sandboxes/"+url.PathEscape(id)+"/resume", nil, nil)
+}
+
+// RenewExpiration renews the sandbox's absolute expiration time.
+// The caller is responsible for computing the desired expiresAt time.
+func (c *LifecycleClient) RenewExpiration(ctx context.Context, id string, expiresAt time.Time) (*RenewExpirationResponse, error) {
+	req := RenewExpirationRequest{
+		ExpiresAt: expiresAt.UTC(),
+	}
+	var resp RenewExpirationResponse
+	if err := c.doRequest(ctx, "POST", "/sandboxes/"+url.PathEscape(id)+"/renew-expiration", req, &resp); err != nil {
+		return nil, err
+	}
+	return &resp, nil
+}
+
+// GetEndpoint retrieves the public access endpoint for a service running
+// on the specified port inside the sandbox. If useServerProxy is non-nil,
+// the server proxy query parameter is included.
+func (c *LifecycleClient) GetEndpoint(ctx context.Context, sandboxID string, port int, useServerProxy *bool) (*Endpoint, error) {
+	path := fmt.Sprintf("/sandboxes/%s/endpoints/%d", url.PathEscape(sandboxID), port)
+	params := url.Values{}
+	if useServerProxy != nil {
+		params.Set("use_server_proxy", strconv.FormatBool(*useServerProxy))
+	}
+	if encoded := params.Encode(); encoded != "" {
+		path += "?" + encoded
+	}
+	var resp Endpoint
+	if err := c.doRequest(ctx, "GET", path, nil, &resp); err != nil {
+		return nil, err
+	}
+	return &resp, nil
+}
diff --git a/sdks/sandbox/go/opensandbox/manager.go b/sdks/sandbox/go/opensandbox/manager.go
new file mode 100644
index 00000000..71fd18e6
--- /dev/null
+++ b/sdks/sandbox/go/opensandbox/manager.go
@@ -0,0 +1,52 @@
+package opensandbox
+
+import (
+	"context"
+	"time"
+)
+
+// SandboxManager provides administrative operations on sandboxes
+// without connecting to a specific sandbox.
+type SandboxManager struct {
+	lifecycle *LifecycleClient
+}
+
+// NewSandboxManager creates a SandboxManager from the given connection config.
+func NewSandboxManager(config ConnectionConfig) *SandboxManager {
+	return &SandboxManager{
+		lifecycle: config.lifecycleClient(),
+	}
+}
+
+// ListSandboxInfos returns a paginated list of sandboxes with optional filtering.
+func (m *SandboxManager) ListSandboxInfos(ctx context.Context, filter ListOptions) (*ListSandboxesResponse, error) {
+	return m.lifecycle.ListSandboxes(ctx, filter)
+}
+
+// GetSandboxInfo retrieves info for a single sandbox by ID.
+func (m *SandboxManager) GetSandboxInfo(ctx context.Context, sandboxID string) (*SandboxInfo, error) {
+	return m.lifecycle.GetSandbox(ctx, sandboxID)
+}
+
+// KillSandbox terminates a sandbox by ID.
+func (m *SandboxManager) KillSandbox(ctx context.Context, sandboxID string) error {
+	return m.lifecycle.DeleteSandbox(ctx, sandboxID)
+}
+
+// PauseSandbox pauses a running sandbox by ID.
+func (m *SandboxManager) PauseSandbox(ctx context.Context, sandboxID string) error {
+	return m.lifecycle.PauseSandbox(ctx, sandboxID)
+}
+
+// ResumeSandbox resumes a paused sandbox by ID.
+func (m *SandboxManager) ResumeSandbox(ctx context.Context, sandboxID string) error {
+	return m.lifecycle.ResumeSandbox(ctx, sandboxID)
+}
+
+// RenewSandbox extends a sandbox's expiration by the given duration from now.
+func (m *SandboxManager) RenewSandbox(ctx context.Context, sandboxID string, duration time.Duration) (*RenewExpirationResponse, error) {
+	return m.lifecycle.RenewExpiration(ctx, sandboxID, time.Now().Add(duration))
+}
+
+// Close releases local resources. Currently a no-op placeholder.
+func (m *SandboxManager) Close() {}
diff --git a/sdks/sandbox/go/opensandbox/opensandbox_test.go b/sdks/sandbox/go/opensandbox/opensandbox_test.go
new file mode 100644
index 00000000..165b1e3a
--- /dev/null
+++ b/sdks/sandbox/go/opensandbox/opensandbox_test.go
@@ -0,0 +1,702 @@
+package opensandbox
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+)
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+// newLifecycleServer creates an httptest.Server and a LifecycleClient pointing at it.
+func newLifecycleServer(t *testing.T, handler http.HandlerFunc) (*httptest.Server, *LifecycleClient) {
+	t.Helper()
+	srv := httptest.NewServer(handler)
+	t.Cleanup(srv.Close)
+	client := NewLifecycleClient(srv.URL, "test-api-key")
+	return srv, client
+}
+
+// newEgressServer creates an httptest.Server and an EgressClient pointing at it.
+func newEgressServer(t *testing.T, handler http.HandlerFunc) (*httptest.Server, *EgressClient) {
+	t.Helper()
+	srv := httptest.NewServer(handler)
+	t.Cleanup(srv.Close)
+	client := NewEgressClient(srv.URL, "test-egress-token")
+	return srv, client
+}
+
+// newExecdServer creates an httptest.Server and an ExecdClient pointing at it.
+func newExecdServer(t *testing.T, handler http.HandlerFunc) (*httptest.Server, *ExecdClient) {
+	t.Helper()
+	srv := httptest.NewServer(handler)
+	t.Cleanup(srv.Close)
+	client := NewExecdClient(srv.URL, "test-execd-token")
+	return srv, client
+}
+
+func jsonResponse(w http.ResponseWriter, status int, v any) {
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(status)
+	json.NewEncoder(w).Encode(v)
+}
+
+// ---------------------------------------------------------------------------
+// Lifecycle tests
+// ---------------------------------------------------------------------------
+
+func TestCreateSandbox(t *testing.T) {
+	now := time.Now().UTC().Truncate(time.Second)
+	want := SandboxInfo{
+		ID: "sbx-123",
+		Status: SandboxStatus{
+			State: StatePending,
+		},
+		CreatedAt: now,
+	}
+
+	_, client := newLifecycleServer(t, func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != http.MethodPost {
+			t.Errorf("expected POST, got %s", r.Method)
+		}
+		if r.URL.Path != "/sandboxes" {
+			t.Errorf("expected /sandboxes, got %s", r.URL.Path)
+		}
+
+		var req CreateSandboxRequest
+		json.NewDecoder(r.Body).Decode(&req)
+		if req.Image.URI != "python:3.12" {
+			t.Errorf("expected image python:3.12, got %s", req.Image.URI)
+		}
+
+		jsonResponse(w, http.StatusCreated, want)
+	})
+
+	got, err := client.CreateSandbox(context.Background(), CreateSandboxRequest{
+		Image:      ImageSpec{URI: "python:3.12"},
+		Entrypoint: []string{"/bin/sh"},
+		ResourceLimits: ResourceLimits{
+			"cpu":    "500m",
+			"memory": "512Mi",
+		},
+	})
+	if err != nil {
+		t.Fatalf("CreateSandbox: %v", err)
+	}
+	if got.ID != want.ID {
+		t.Errorf("ID = %q, want %q", got.ID, want.ID)
+	}
+	if got.Status.State != StatePending {
+		t.Errorf("State = %q, want %q", got.Status.State, StatePending)
+	}
+}
+
+func TestGetSandbox(t *testing.T) {
+	want := SandboxInfo{
+		ID: "sbx-456",
+		Status: SandboxStatus{
+			State: StateRunning,
+		},
+		CreatedAt: time.Now().UTC().Truncate(time.Second),
+	}
+
+	_, client := newLifecycleServer(t, func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != http.MethodGet {
+			t.Errorf("expected GET, got %s", r.Method)
+		}
+		if r.URL.Path != "/sandboxes/sbx-456" {
+			t.Errorf("expected /sandboxes/sbx-456, got %s", r.URL.Path)
+		}
+		jsonResponse(w, http.StatusOK, want)
+	})
+
+	got, err := client.GetSandbox(context.Background(), "sbx-456")
+	if err != nil {
+		t.Fatalf("GetSandbox: %v", err)
+	}
+	if got.ID != want.ID {
+		t.Errorf("ID = %q, want %q", got.ID, want.ID)
+	}
+	if got.Status.State != StateRunning {
+		t.Errorf("State = %q, want %q", got.Status.State, StateRunning)
+	}
+}
+
+func TestListSandboxes(t *testing.T) {
+	want := ListSandboxesResponse{
+		Items: []SandboxInfo{
+			{ID: "sbx-1", Status: SandboxStatus{State: StateRunning}, CreatedAt: time.Now().UTC().Truncate(time.Second)},
+			{ID: "sbx-2", Status: SandboxStatus{State: StatePaused}, CreatedAt: time.Now().UTC().Truncate(time.Second)},
+		},
+		Pagination: PaginationInfo{
+			Page:        1,
+			PageSize:    20,
+			TotalItems:  2,
+			TotalPages:  1,
+			HasNextPage: false,
+		},
+	}
+
+	_, client := newLifecycleServer(t, func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != http.MethodGet {
+			t.Errorf("expected GET, got %s", r.Method)
+		}
+		if !strings.HasPrefix(r.URL.Path, "/sandboxes") {
+			t.Errorf("expected /sandboxes prefix, got %s", r.URL.Path)
+		}
+		if r.URL.Query().Get("page") != "1" {
+			t.Errorf("expected page=1, got %s", r.URL.Query().Get("page"))
+		}
+		if r.URL.Query().Get("pageSize") != "20" {
+			t.Errorf("expected pageSize=20, got %s", r.URL.Query().Get("pageSize"))
+		}
+		jsonResponse(w, http.StatusOK, want)
+	})
+
+	got, err := client.ListSandboxes(context.Background(), ListOptions{
+		Page:     1,
+		PageSize: 20,
+	})
+	if err != nil {
+		t.Fatalf("ListSandboxes: %v", err)
+	}
+	if len(got.Items) != 2 {
+		t.Fatalf("expected 2 items, got %d", len(got.Items))
+	}
+	if got.Pagination.TotalItems != 2 {
+		t.Errorf("TotalItems = %d, want 2", got.Pagination.TotalItems)
+	}
+}
+
+func TestDeleteSandbox(t *testing.T) {
+	_, client := newLifecycleServer(t, func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != http.MethodDelete {
+			t.Errorf("expected DELETE, got %s", r.Method)
+		}
+		if r.URL.Path != "/sandboxes/sbx-789" {
+			t.Errorf("expected /sandboxes/sbx-789, got %s", r.URL.Path)
+		}
+		w.WriteHeader(http.StatusNoContent)
+	})
+
+	err := client.DeleteSandbox(context.Background(), "sbx-789")
+	if err != nil {
+		t.Fatalf("DeleteSandbox: %v", err)
+	}
+}
+
+func TestPauseSandbox(t *testing.T) {
+	_, client := newLifecycleServer(t, func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != http.MethodPost {
+			t.Errorf("expected POST, got %s", r.Method)
+		}
+		if r.URL.Path != "/sandboxes/sbx-pause/pause" {
+			t.Errorf("expected /sandboxes/sbx-pause/pause, got %s", r.URL.Path)
+		}
+		w.WriteHeader(http.StatusAccepted)
+	})
+
+	err := client.PauseSandbox(context.Background(), "sbx-pause")
+	if err != nil {
+		t.Fatalf("PauseSandbox: %v", err)
+	}
+}
+
+func TestAPIError(t *testing.T) {
+	_, client := newLifecycleServer(t, func(w http.ResponseWriter, r *http.Request) {
+		jsonResponse(w, http.StatusNotFound, ErrorResponse{
+			Code:    "SANDBOX_NOT_FOUND",
+			Message: "sandbox sbx-missing does not exist",
+		})
+	})
+
+	_, err := client.GetSandbox(context.Background(), "sbx-missing")
+	if err == nil {
+		t.Fatal("expected error, got nil")
+	}
+
+	apiErr, ok := err.(*APIError)
+	if !ok {
+		t.Fatalf("expected *APIError, got %T", err)
+	}
+	if apiErr.StatusCode != http.StatusNotFound {
+		t.Errorf("StatusCode = %d, want %d", apiErr.StatusCode, http.StatusNotFound)
+	}
+	if apiErr.Response.Code != "SANDBOX_NOT_FOUND" {
+		t.Errorf("Code = %q, want %q", apiErr.Response.Code, "SANDBOX_NOT_FOUND")
+	}
+	if !strings.Contains(apiErr.Error(), "SANDBOX_NOT_FOUND") {
+		t.Errorf("Error() = %q, expected to contain SANDBOX_NOT_FOUND", apiErr.Error())
+	}
+}
+
+// ---------------------------------------------------------------------------
+// Egress tests
+// ---------------------------------------------------------------------------
+
+func TestGetPolicy(t *testing.T) {
+	want := PolicyStatusResponse{
+		Status:          "active",
+		Mode:            "enforce",
+		EnforcementMode: "strict",
+		Policy: &NetworkPolicy{
+			DefaultAction: "deny",
+			Egress: []NetworkRule{
+				{Action: "allow", Target: "api.example.com"},
+			},
+		},
+	}
+
+	_, client := newEgressServer(t, func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != http.MethodGet {
+			t.Errorf("expected GET, got %s", r.Method)
+		}
+		if r.URL.Path != "/policy" {
+			t.Errorf("expected /policy, got %s", r.URL.Path)
+		}
+		jsonResponse(w, http.StatusOK, want)
+	})
+
+	got, err := client.GetPolicy(context.Background())
+	if err != nil {
+		t.Fatalf("GetPolicy: %v", err)
+	}
+	if got.Status != "active" {
+		t.Errorf("Status = %q, want %q", got.Status, "active")
+	}
+	if got.Policy == nil || len(got.Policy.Egress) != 1 {
+		t.Fatal("expected 1 egress rule")
+	}
+	if got.Policy.Egress[0].Target != "api.example.com" {
+		t.Errorf("Target = %q, want %q", got.Policy.Egress[0].Target, "api.example.com")
+	}
+}
+
+func TestPatchPolicy(t *testing.T) {
+	want := PolicyStatusResponse{
+		Status: "active",
+		Mode:   "enforce",
+		Policy: &NetworkPolicy{
+			DefaultAction: "deny",
+			Egress: []NetworkRule{
+				{Action: "allow", Target: "api.example.com"},
+				{Action: "allow", Target: "cdn.example.com"},
+			},
+		},
+	}
+
+	_, client := newEgressServer(t, func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != http.MethodPatch {
+			t.Errorf("expected PATCH, got %s", r.Method)
+		}
+
+		var rules []NetworkRule
+		json.NewDecoder(r.Body).Decode(&rules)
+		if len(rules) != 1 {
+			t.Errorf("expected 1 rule in request, got %d", len(rules))
+		}
+
+		jsonResponse(w, http.StatusOK, want)
+	})
+
+	got, err := client.PatchPolicy(context.Background(), []NetworkRule{
+		{Action: "allow", Target: "cdn.example.com"},
+	})
+	if err != nil {
+		t.Fatalf("PatchPolicy: %v", err)
+	}
+	if got.Policy == nil || len(got.Policy.Egress) != 2 {
+		t.Fatalf("expected 2 egress rules, got %v", got.Policy)
+	}
+}
+
+// ---------------------------------------------------------------------------
+// Execd tests
+// ---------------------------------------------------------------------------
+
+func TestPing(t *testing.T) {
+	_, client := newExecdServer(t, func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != http.MethodGet {
+			t.Errorf("expected GET, got %s", r.Method)
+		}
+		if r.URL.Path != "/ping" {
+			t.Errorf("expected /ping, got %s", r.URL.Path)
+		}
+		w.WriteHeader(http.StatusOK)
+	})
+
+	err := client.Ping(context.Background())
+	if err != nil {
+		t.Fatalf("Ping: %v", err)
+	}
+}
+
+func TestRunCommand_SSE(t *testing.T) {
+	ssePayload := "event: stdout\ndata: hello world\n\nevent: stderr\ndata: warning\n\nevent: result\ndata: {\"exit_code\": 0}\n\n"
+
+	_, client := newExecdServer(t, func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != http.MethodPost {
+			t.Errorf("expected POST, got %s", r.Method)
+		}
+		if r.URL.Path != "/command" {
+			t.Errorf("expected /command, got %s", r.URL.Path)
+		}
+
+		var req RunCommandRequest
+		json.NewDecoder(r.Body).Decode(&req)
+		if req.Command != "echo hello" {
+			t.Errorf("Command = %q, want %q", req.Command, "echo hello")
+		}
+
+		w.Header().Set("Content-Type", "text/event-stream")
+		w.WriteHeader(http.StatusOK)
+		w.Write([]byte(ssePayload))
+	})
+
+	var mu sync.Mutex
+	var events []StreamEvent
+	err := client.RunCommand(context.Background(), RunCommandRequest{
+		Command: "echo hello",
+	}, func(event StreamEvent) error {
+		mu.Lock()
+		events = append(events, event)
+		mu.Unlock()
+		return nil
+	})
+	if err != nil {
+		t.Fatalf("RunCommand: %v", err)
+	}
+
+	if len(events) != 3 {
+		t.Fatalf("expected 3 events, got %d", len(events))
+	}
+	if events[0].Event != "stdout" || events[0].Data != "hello world" {
+		t.Errorf("event[0] = %+v, want stdout/hello world", events[0])
+	}
+	if events[1].Event != "stderr" || events[1].Data != "warning" {
+		t.Errorf("event[1] = %+v, want stderr/warning", events[1])
+	}
+	if events[2].Event != "result" {
+		t.Errorf("event[2].Event = %q, want result", events[2].Event)
+	}
+}
+
+func TestGetFileInfo(t *testing.T) {
+	want := map[string]FileInfo{
+		"/tmp/test.txt": {
+			Path:       "/tmp/test.txt",
+			Size:       1024,
+			ModifiedAt: time.Now().UTC().Truncate(time.Second),
+			CreatedAt:  time.Now().UTC().Truncate(time.Second),
+			Owner:      "root",
+			Group:      "root",
+			Mode:       0644,
+		},
+	}
+
+	_, client := newExecdServer(t, func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != http.MethodGet {
+			t.Errorf("expected GET, got %s", r.Method)
+		}
+		if !strings.HasPrefix(r.URL.Path, "/files/info") {
+			t.Errorf("expected /files/info, got %s", r.URL.Path)
+		}
+		if r.URL.Query().Get("path") != "/tmp/test.txt" {
+			t.Errorf("expected path=/tmp/test.txt, got %s", r.URL.Query().Get("path"))
+		}
+		jsonResponse(w, http.StatusOK, want)
+	})
+
+	got, err := client.GetFileInfo(context.Background(), "/tmp/test.txt")
+	if err != nil {
+		t.Fatalf("GetFileInfo: %v", err)
+	}
+	info, ok := got["/tmp/test.txt"]
+	if !ok {
+		t.Fatal("expected /tmp/test.txt in result")
+	}
+	if info.Size != 1024 {
+		t.Errorf("Size = %d, want 1024", info.Size)
+	}
+	if info.Owner != "root" {
+		t.Errorf("Owner = %q, want root", info.Owner)
+	}
+}
+
+func TestUploadFile(t *testing.T) {
+	// Create a temp file to upload.
+	tmpFile, err := os.CreateTemp("", "opensandbox-test-*")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer os.Remove(tmpFile.Name())
+	tmpFile.WriteString("file contents here")
+	tmpFile.Close()
+
+	_, client := newExecdServer(t, func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != http.MethodPost {
+			t.Errorf("expected POST, got %s", r.Method)
+		}
+		if r.URL.Path != "/files/upload" {
+			t.Errorf("expected /files/upload, got %s", r.URL.Path)
+		}
+		if !strings.HasPrefix(r.Header.Get("Content-Type"), "multipart/form-data") {
+			t.Errorf("expected multipart content type, got %s", r.Header.Get("Content-Type"))
+		}
+
+		// Verify metadata part exists.
+		r.ParseMultipartForm(1 << 20)
+		metaStr := r.FormValue("metadata")
+		if metaStr == "" {
+			t.Error("expected metadata form field")
+		}
+		var meta FileMetadata
+		json.Unmarshal([]byte(metaStr), &meta)
+		if meta.Path != "/sandbox/upload.txt" {
+			t.Errorf("metadata path = %q, want /sandbox/upload.txt", meta.Path)
+		}
+
+		// Verify file part exists.
+		file, _, fErr := r.FormFile("file")
+		if fErr != nil {
+			t.Errorf("expected file part: %v", fErr)
+		} else {
+			data, _ := io.ReadAll(file)
+			if string(data) != "file contents here" {
+				t.Errorf("file content = %q, want %q", string(data), "file contents here")
+			}
+			file.Close()
+		}
+
+		w.WriteHeader(http.StatusOK)
+	})
+
+	err = client.UploadFile(context.Background(), tmpFile.Name(), "/sandbox/upload.txt")
+	if err != nil {
+		t.Fatalf("UploadFile: %v", err)
+	}
+}
+
+func TestGetMetrics(t *testing.T) {
+	want := Metrics{
+		CPUCount:   4,
+		CPUUsedPct: 25.5,
+		MemTotalMB: 8192,
+		MemUsedMB:  4096,
+		Timestamp:  time.Now().Unix(),
+	}
+
+	_, client := newExecdServer(t, func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != http.MethodGet {
+			t.Errorf("expected GET, got %s", r.Method)
+		}
+		if r.URL.Path != "/metrics" {
+			t.Errorf("expected /metrics, got %s", r.URL.Path)
+		}
+		jsonResponse(w, http.StatusOK, want)
+	})
+
+	got, err := client.GetMetrics(context.Background())
+	if err != nil {
+		t.Fatalf("GetMetrics: %v", err)
+	}
+	if got.CPUCount != 4 {
+		t.Errorf("CPUCount = %f, want 4", got.CPUCount)
+	}
+	if got.MemTotalMB != 8192 {
+		t.Errorf("MemTotalMB = %f, want 8192", got.MemTotalMB)
+	}
+}
+
+// ---------------------------------------------------------------------------
+// SSE streaming test
+// ---------------------------------------------------------------------------
+
+func TestStreamSSE(t *testing.T) {
+	ssePayload := strings.Join([]string{
+		"event: start",
+		"data: initializing",
+		"",
+		"event: progress",
+		"data: step 1",
+		"data: step 2",
+		"",
+		"id: evt-3",
+		"event: done",
+		"data: complete",
+		"",
+		": this is a comment",
+		"event: final",
+		"data: goodbye",
+		"",
+	}, "\n")
+
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "text/event-stream")
+		w.WriteHeader(http.StatusOK)
+		w.Write([]byte(ssePayload))
+	}))
+	defer srv.Close()
+
+	client := NewExecdClient(srv.URL, "tok")
+
+	var events []StreamEvent
+	err := client.RunCommand(context.Background(), RunCommandRequest{
+		Command: "test",
+	}, func(event StreamEvent) error {
+		events = append(events, event)
+		return nil
+	})
+	if err != nil {
+		t.Fatalf("stream: %v", err)
+	}
+
+	if len(events) != 4 {
+		t.Fatalf("expected 4 events, got %d: %+v", len(events), events)
+	}
+
+	// Event 1: start
+	if events[0].Event != "start" || events[0].Data != "initializing" {
+		t.Errorf("event[0] = %+v", events[0])
+	}
+
+	// Event 2: progress with multi-line data
+	if events[1].Event != "progress" || events[1].Data != "step 1\nstep 2" {
+		t.Errorf("event[1] = %+v, want progress/step 1\\nstep 2", events[1])
+	}
+
+	// Event 3: done with ID
+	if events[2].Event != "done" || events[2].Data != "complete" || events[2].ID != "evt-3" {
+		t.Errorf("event[2] = %+v", events[2])
+	}
+
+	// Event 4: final (comment should be skipped)
+	if events[3].Event != "final" || events[3].Data != "goodbye" {
+		t.Errorf("event[3] = %+v", events[3])
+	}
+}
+
+// ---------------------------------------------------------------------------
+// NDJSON streaming test
+// ---------------------------------------------------------------------------
+
+func TestStreamSSE_NDJSON(t *testing.T) {
+	// Simulate the real execd server format: raw JSON blobs separated by blank lines.
+	ndjsonPayload := "{\"type\":\"stdout\",\"data\":\"hello\"}\n\n{\"type\":\"result\",\"exit_code\":0}\n\n"
+
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "text/event-stream")
+		w.WriteHeader(http.StatusOK)
+		w.Write([]byte(ndjsonPayload))
+	}))
+	defer srv.Close()
+
+	client := NewExecdClient(srv.URL, "tok")
+
+	var events []StreamEvent
+	err := client.RunCommand(context.Background(), RunCommandRequest{
+		Command: "test",
+	}, func(event StreamEvent) error {
+		events = append(events, event)
+		return nil
+	})
+	if err != nil {
+		t.Fatalf("stream: %v", err)
+	}
+
+	if len(events) != 2 {
+		t.Fatalf("expected 2 events, got %d: %+v", len(events), events)
+	}
+
+	// NDJSON events should have empty Event field and raw JSON as Data.
+	if events[0].Event != "" {
+		t.Errorf("event[0].Event = %q, want empty", events[0].Event)
+	}
+	if events[0].Data != `{"type":"stdout","data":"hello"}` {
+		t.Errorf("event[0].Data = %q", events[0].Data)
+	}
+	if events[1].Data != `{"type":"result","exit_code":0}` {
+		t.Errorf("event[1].Data = %q", events[1].Data)
+	}
+}
+
+// ---------------------------------------------------------------------------
+// Auth header tests
+// ---------------------------------------------------------------------------
+
+func TestLifecycleAuthHeader(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		got := r.Header.Get("OPEN-SANDBOX-API-KEY")
+		if got != "my-lifecycle-key" {
+			t.Errorf("OPEN-SANDBOX-API-KEY = %q, want %q", got, "my-lifecycle-key")
+		}
+		jsonResponse(w, http.StatusOK, SandboxInfo{ID: "sbx-1", CreatedAt: time.Now()})
+	}))
+	defer srv.Close()
+
+	client := NewLifecycleClient(srv.URL, "my-lifecycle-key")
+	_, err := client.GetSandbox(context.Background(), "sbx-1")
+	if err != nil {
+		t.Fatalf("GetSandbox: %v", err)
+	}
+}
+
+func TestExecdAuthHeader(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		got := r.Header.Get("X-EXECD-ACCESS-TOKEN")
+		if got != "my-execd-token" {
+			t.Errorf("X-EXECD-ACCESS-TOKEN = %q, want %q", got, "my-execd-token")
+		}
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer srv.Close()
+
+	client := NewExecdClient(srv.URL, "my-execd-token")
+	err := client.Ping(context.Background())
+	if err != nil {
+		t.Fatalf("Ping: %v", err)
+	}
+}
+
+// ---------------------------------------------------------------------------
+// Handler error propagation
+// ---------------------------------------------------------------------------
+
+func TestStreamSSE_HandlerError(t *testing.T) {
+	ssePayload := "event: first\ndata: a\n\nevent: second\ndata: b\n\n"
+
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "text/event-stream")
+		w.WriteHeader(http.StatusOK)
+		w.Write([]byte(ssePayload))
+	}))
+	defer srv.Close()
+
+	client := NewExecdClient(srv.URL, "tok")
+	stopErr := fmt.Errorf("stop after first")
+
+	var count int
+	err := client.RunCommand(context.Background(), RunCommandRequest{Command: "x"}, func(event StreamEvent) error {
+		count++
+		if count == 1 {
+			return stopErr
+		}
+		return nil
+	})
+	if err != stopErr {
+		t.Errorf("expected stopErr, got %v", err)
+	}
+	if count != 1 {
+		t.Errorf("handler called %d times, want 1", count)
+	}
+}
diff --git a/sdks/sandbox/go/opensandbox/sandbox.go b/sdks/sandbox/go/opensandbox/sandbox.go
new file mode 100644
index 00000000..07f4a06f
--- /dev/null
+++ b/sdks/sandbox/go/opensandbox/sandbox.go
@@ -0,0 +1,560 @@
+package opensandbox
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"strings"
+	"sync"
+	"time"
+)
+
+// SandboxCreateOptions configures sandbox creation.
+type SandboxCreateOptions struct {
+	// Image is the container image URI (required).
+	Image string
+
+	// Entrypoint is the command to run. Defaults to DefaultEntrypoint.
+	Entrypoint []string
+
+	// Resource limits (e.g. {"cpu": "500m", "memory": "256Mi"}).
+	// Defaults to DefaultResourceLimits.
+	ResourceLimits ResourceLimits
+
+	// TimeoutSeconds is the sandbox TTL. Nil means use DefaultTimeoutSeconds.
+	TimeoutSeconds *int
+
+	// Env variables injected into the sandbox.
+	Env map[string]string
+
+	// Metadata for filtering and tagging.
+	Metadata map[string]string
+
+	// NetworkPolicy for egress control.
+	NetworkPolicy *NetworkPolicy
+
+	// Volumes to mount.
+	Volumes []Volume
+
+	// Extensions for provider-specific parameters.
+	Extensions map[string]string
+
+	// SkipHealthCheck skips the WaitUntilReady call after creation.
+	SkipHealthCheck bool
+
+	// ReadyTimeout overrides DefaultReadyTimeoutSeconds.
+	ReadyTimeout time.Duration
+
+	// HealthCheckInterval overrides DefaultHealthCheckPollingInterval.
+	HealthCheckInterval time.Duration
+
+	// HealthCheck is a custom health check function. If nil, execd /ping is used.
+	HealthCheck func(ctx context.Context, sb *Sandbox) (bool, error)
+}
+
+// Sandbox is the high-level object wrapping lifecycle, execd, and egress clients.
+// Use CreateSandbox or ConnectSandbox to obtain an instance.
+type Sandbox struct {
+	id     string
+	config *ConnectionConfig
+
+	lifecycle *LifecycleClient
+	execd     *ExecdClient
+	egress    *EgressClient
+	mu        sync.Mutex
+}
+
+// ID returns the sandbox identifier.
+func (s *Sandbox) ID() string { return s.id }
+
+// CreateSandbox creates a new sandbox and waits for it to be ready.
+func CreateSandbox(ctx context.Context, config ConnectionConfig, opts SandboxCreateOptions) (*Sandbox, error) {
+	if opts.Image == "" {
+		return nil, &InvalidArgumentError{Field: "Image", Message: "image is required"}
+	}
+
+	entrypoint := opts.Entrypoint
+	if len(entrypoint) == 0 {
+		entrypoint = DefaultEntrypoint
+	}
+	limits := opts.ResourceLimits
+	if limits == nil {
+		limits = DefaultResourceLimits
+	}
+	timeout := opts.TimeoutSeconds
+	if timeout == nil {
+		t := DefaultTimeoutSeconds
+		timeout = &t
+	}
+
+	lc := config.lifecycleClient()
+
+	req := CreateSandboxRequest{
+		Image:          ImageSpec{URI: opts.Image},
+		Entrypoint:     entrypoint,
+		ResourceLimits: limits,
+		Timeout:        timeout,
+		Env:            opts.Env,
+		Metadata:       opts.Metadata,
+		NetworkPolicy:  opts.NetworkPolicy,
+		Volumes:        opts.Volumes,
+		Extensions:     opts.Extensions,
+	}
+
+	created, err := lc.CreateSandbox(ctx, req)
+	if err != nil {
+		return nil, fmt.Errorf("opensandbox: create sandbox: %w", err)
+	}
+
+	sb := &Sandbox{
+		id:        created.ID,
+		config:    &config,
+		lifecycle: lc,
+	}
+
+	// Poll until Running
+	if err := sb.waitForRunning(ctx); err != nil {
+		// Best-effort cleanup
+		_ = lc.DeleteSandbox(context.Background(), created.ID)
+		return nil, err
+	}
+
+	// Resolve execd endpoint
+	if err := sb.resolveExecd(ctx); err != nil {
+		_ = lc.DeleteSandbox(context.Background(), created.ID)
+		return nil, fmt.Errorf("opensandbox: resolve execd: %w", err)
+	}
+
+	// Wait until execd is ready
+	if !opts.SkipHealthCheck {
+		readyOpts := ReadyOptions{
+			Timeout:         opts.ReadyTimeout,
+			PollingInterval: opts.HealthCheckInterval,
+			HealthCheck:     opts.HealthCheck,
+		}
+		if err := sb.WaitUntilReady(ctx, readyOpts); err != nil {
+			_ = lc.DeleteSandbox(context.Background(), created.ID)
+			return nil, err
+		}
+	}
+
+	return sb, nil
+}
+
+// ConnectSandbox connects to an existing running sandbox by ID.
+func ConnectSandbox(ctx context.Context, config ConnectionConfig, sandboxID string, opts ...ReadyOptions) (*Sandbox, error) {
+	if sandboxID == "" {
+		return nil, &InvalidArgumentError{Field: "sandboxID", Message: "sandbox ID is required"}
+	}
+
+	lc := config.lifecycleClient()
+
+	sb := &Sandbox{
+		id:        sandboxID,
+		config:    &config,
+		lifecycle: lc,
+	}
+
+	if err := sb.resolveExecd(ctx); err != nil {
+		return nil, fmt.Errorf("opensandbox: resolve execd: %w", err)
+	}
+
+	// Optional readiness check
+	if len(opts) > 0 {
+		if err := sb.WaitUntilReady(ctx, opts[0]); err != nil {
+			return nil, err
+		}
+	}
+
+	return sb, nil
+}
+
+// Kill terminates the sandbox. This is irreversible.
+func (s *Sandbox) Kill(ctx context.Context) error {
+	return s.lifecycle.DeleteSandbox(ctx, s.id)
+}
+
+// Close releases local HTTP resources. Does NOT terminate the sandbox.
+func (s *Sandbox) Close() {
+	// No-op for now — Go's http.Client doesn't need explicit close.
+	// Placeholder for future transport pooling.
+}
+
+// Pause pauses the sandbox while preserving its state.
+func (s *Sandbox) Pause(ctx context.Context) error {
+	return s.lifecycle.PauseSandbox(ctx, s.id)
+}
+
+// GetInfo returns the sandbox's current info (status, metadata, image, etc.).
+func (s *Sandbox) GetInfo(ctx context.Context) (*SandboxInfo, error) {
+	return s.lifecycle.GetSandbox(ctx, s.id)
+}
+
+// GetMetrics returns current system resource metrics from the sandbox.
+func (s *Sandbox) GetMetrics(ctx context.Context) (*Metrics, error) {
+	if s.execd == nil {
+		return nil, fmt.Errorf("opensandbox: execd client not initialized")
+	}
+	return s.execd.GetMetrics(ctx)
+}
+
+// IsHealthy checks whether the sandbox's execd service is responsive.
+func (s *Sandbox) IsHealthy(ctx context.Context) bool {
+	if s.execd == nil {
+		return false
+	}
+	return s.execd.Ping(ctx) == nil
+}
+
+// Renew extends the sandbox's expiration by the given duration from now.
+func (s *Sandbox) Renew(ctx context.Context, duration time.Duration) (*RenewExpirationResponse, error) {
+	return s.lifecycle.RenewExpiration(ctx, s.id, time.Now().Add(duration))
+}
+
+// GetEndpoint retrieves the public access endpoint for a service port.
+func (s *Sandbox) GetEndpoint(ctx context.Context, port int) (*Endpoint, error) {
+	useProxy := s.config.UseServerProxy
+	return s.lifecycle.GetEndpoint(ctx, s.id, port, &useProxy)
+}
+
+// GetEgressPolicy retrieves the current egress network policy.
+func (s *Sandbox) GetEgressPolicy(ctx context.Context) (*PolicyStatusResponse, error) {
+	if err := s.resolveEgress(ctx); err != nil {
+		return nil, err
+	}
+	return s.egress.GetPolicy(ctx)
+}
+
+// PatchEgressRules merges network rules into the current egress policy.
+func (s *Sandbox) PatchEgressRules(ctx context.Context, rules []NetworkRule) (*PolicyStatusResponse, error) {
+	if err := s.resolveEgress(ctx); err != nil {
+		return nil, err
+	}
+	return s.egress.PatchPolicy(ctx, rules)
+}
+
+// RunCommand executes a shell command and returns the structured result.
+func (s *Sandbox) RunCommand(ctx context.Context, command string, handlers *ExecutionHandlers) (*Execution, error) {
+	return s.RunCommandWithOpts(ctx, RunCommandRequest{Command: command}, handlers)
+}
+
+// RunCommandWithOpts executes a command with full options.
+func (s *Sandbox) RunCommandWithOpts(ctx context.Context, req RunCommandRequest, handlers *ExecutionHandlers) (*Execution, error) {
+	if s.execd == nil {
+		return nil, fmt.Errorf("opensandbox: execd client not initialized")
+	}
+
+	exec := &Execution{}
+	err := s.execd.RunCommand(ctx, req, func(event StreamEvent) error {
+		return processStreamEvent(exec, event, handlers)
+	})
+	if err != nil {
+		return exec, err
+	}
+	return exec, nil
+}
+
+// Ping checks if the execd service is responsive.
+func (s *Sandbox) Ping(ctx context.Context) error {
+	if s.execd == nil {
+		return fmt.Errorf("opensandbox: execd client not initialized")
+	}
+	return s.execd.Ping(ctx)
+}
+
+// GetFileInfo retrieves file metadata.
+func (s *Sandbox) GetFileInfo(ctx context.Context, path string) (map[string]FileInfo, error) {
+	if s.execd == nil {
+		return nil, fmt.Errorf("opensandbox: execd client not initialized")
+	}
+	return s.execd.GetFileInfo(ctx, path)
+}
+
+// DeleteFiles deletes one or more files from the sandbox.
+func (s *Sandbox) DeleteFiles(ctx context.Context, paths []string) error {
+	if s.execd == nil {
+		return fmt.Errorf("opensandbox: execd client not initialized")
+	}
+	return s.execd.DeleteFiles(ctx, paths)
+}
+
+// MoveFiles renames or moves files.
+func (s *Sandbox) MoveFiles(ctx context.Context, req MoveRequest) error {
+	if s.execd == nil {
+		return fmt.Errorf("opensandbox: execd client not initialized")
+	}
+	return s.execd.MoveFiles(ctx, req)
+}
+
+// SearchFiles searches for files matching a pattern.
+func (s *Sandbox) SearchFiles(ctx context.Context, dir, pattern string) ([]FileInfo, error) {
+	if s.execd == nil {
+		return nil, fmt.Errorf("opensandbox: execd client not initialized")
+	}
+	return s.execd.SearchFiles(ctx, dir, pattern)
+}
+
+// SetPermissions changes file permissions.
+func (s *Sandbox) SetPermissions(ctx context.Context, req PermissionsRequest) error {
+	if s.execd == nil {
+		return fmt.Errorf("opensandbox: execd client not initialized")
+	}
+	return s.execd.SetPermissions(ctx, req)
+}
+
+// UploadFile uploads a local file to the sandbox.
+func (s *Sandbox) UploadFile(ctx context.Context, localPath, remotePath string) error {
+	if s.execd == nil {
+		return fmt.Errorf("opensandbox: execd client not initialized")
+	}
+	return s.execd.UploadFile(ctx, localPath, remotePath)
+}
+
+// DownloadFile downloads a file from the sandbox.
+func (s *Sandbox) DownloadFile(ctx context.Context, remotePath, rangeHeader string) (io.ReadCloser, error) {
+	if s.execd == nil {
+		return nil, fmt.Errorf("opensandbox: execd client not initialized")
+	}
+	return s.execd.DownloadFile(ctx, remotePath, rangeHeader)
+}
+
+// CreateDirectory creates a directory in the sandbox.
+// Mode is octal digits as int (e.g. 755 for rwxr-xr-x).
+func (s *Sandbox) CreateDirectory(ctx context.Context, path string, mode int) error {
+	if s.execd == nil {
+		return fmt.Errorf("opensandbox: execd client not initialized")
+	}
+	return s.execd.CreateDirectory(ctx, path, mode)
+}
+
+// DeleteDirectory deletes a directory and its contents.
+func (s *Sandbox) DeleteDirectory(ctx context.Context, path string) error {
+	if s.execd == nil {
+		return fmt.Errorf("opensandbox: execd client not initialized")
+	}
+	return s.execd.DeleteDirectory(ctx, path)
+}
+
+// ReplaceInFiles performs text replacement in files.
+func (s *Sandbox) ReplaceInFiles(ctx context.Context, req ReplaceRequest) error {
+	if s.execd == nil {
+		return fmt.Errorf("opensandbox: execd client not initialized")
+	}
+	return s.execd.ReplaceInFiles(ctx, req)
+}
+
+// ExecuteCode executes code in a context and streams output via SSE.
+func (s *Sandbox) ExecuteCode(ctx context.Context, req RunCodeRequest, handlers *ExecutionHandlers) (*Execution, error) {
+	if s.execd == nil {
+		return nil, fmt.Errorf("opensandbox: execd client not initialized")
+	}
+	exec := &Execution{}
+	err := s.execd.ExecuteCode(ctx, req, func(event StreamEvent) error {
+		return processStreamEvent(exec, event, handlers)
+	})
+	return exec, err
+}
+
+// CreateContext creates a code execution context.
+func (s *Sandbox) CreateContext(ctx context.Context, req CreateContextRequest) (*CodeContext, error) {
+	if s.execd == nil {
+		return nil, fmt.Errorf("opensandbox: execd client not initialized")
+	}
+	return s.execd.CreateContext(ctx, req)
+}
+
+// ListContexts lists active code execution contexts for a language.
+func (s *Sandbox) ListContexts(ctx context.Context, language string) ([]CodeContext, error) {
+	if s.execd == nil {
+		return nil, fmt.Errorf("opensandbox: execd client not initialized")
+	}
+	return s.execd.ListContexts(ctx, language)
+}
+
+// DeleteContext deletes a code execution context.
+func (s *Sandbox) DeleteContext(ctx context.Context, contextID string) error {
+	if s.execd == nil {
+		return fmt.Errorf("opensandbox: execd client not initialized")
+	}
+	return s.execd.DeleteContext(ctx, contextID)
+}
+
+// CreateSession creates a new bash session.
+func (s *Sandbox) CreateSession(ctx context.Context) (*Session, error) {
+	if s.execd == nil {
+		return nil, fmt.Errorf("opensandbox: execd client not initialized")
+	}
+	return s.execd.CreateSession(ctx)
+}
+
+// RunInSession executes a command in an existing session with structured output.
+func (s *Sandbox) RunInSession(ctx context.Context, sessionID string, req RunInSessionRequest, handlers *ExecutionHandlers) (*Execution, error) {
+	if s.execd == nil {
+		return nil, fmt.Errorf("opensandbox: execd client not initialized")
+	}
+	exec := &Execution{}
+	err := s.execd.RunInSession(ctx, sessionID, req, func(event StreamEvent) error {
+		return processStreamEvent(exec, event, handlers)
+	})
+	return exec, err
+}
+
+// DeleteSession deletes a bash session.
+func (s *Sandbox) DeleteSession(ctx context.Context, sessionID string) error {
+	if s.execd == nil {
+		return fmt.Errorf("opensandbox: execd client not initialized")
+	}
+	return s.execd.DeleteSession(ctx, sessionID)
+}
+
+// ReadyOptions configures WaitUntilReady behavior.
+type ReadyOptions struct {
+	Timeout         time.Duration
+	PollingInterval time.Duration
+	HealthCheck     func(ctx context.Context, sb *Sandbox) (bool, error)
+}
+
+// WaitUntilReady polls the execd /ping endpoint until it responds or the timeout expires.
+func (s *Sandbox) WaitUntilReady(ctx context.Context, opts ReadyOptions) error {
+	timeout := opts.Timeout
+	if timeout == 0 {
+		timeout = time.Duration(DefaultReadyTimeoutSeconds) * time.Second
+	}
+	interval := opts.PollingInterval
+	if interval == 0 {
+		interval = DefaultHealthCheckPollingInterval
+	}
+
+	deadline := time.Now().Add(timeout)
+	var lastErr error
+
+	for time.Now().Before(deadline) {
+		if ctx.Err() != nil {
+			return ctx.Err()
+		}
+
+		var healthy bool
+		if opts.HealthCheck != nil {
+			var err error
+			healthy, err = opts.HealthCheck(ctx, s)
+			if err != nil {
+				lastErr = err
+			}
+		} else {
+			err := s.execd.Ping(ctx)
+			healthy = err == nil
+			if err != nil {
+				lastErr = err
+			}
+		}
+
+		if healthy {
+			return nil
+		}
+
+		time.Sleep(interval)
+	}
+
+	return &SandboxReadyTimeoutError{
+		SandboxID: s.id,
+		Elapsed:   timeout.String(),
+		LastErr:   lastErr,
+	}
+}
+
+// waitForRunning polls the lifecycle API until the sandbox reaches Running state.
+func (s *Sandbox) waitForRunning(ctx context.Context) error {
+	for {
+		if ctx.Err() != nil {
+			return fmt.Errorf("opensandbox: sandbox %s did not reach Running state: %w", s.id, ctx.Err())
+		}
+		info, err := s.lifecycle.GetSandbox(ctx, s.id)
+		if err != nil {
+			return fmt.Errorf("opensandbox: get sandbox status: %w", err)
+		}
+		if info.Status.State == StateRunning {
+			return nil
+		}
+		if info.Status.State == StateFailed || info.Status.State == StateTerminated {
+			return fmt.Errorf("opensandbox: sandbox %s entered terminal state: %s (%s)",
+				s.id, info.Status.State, info.Status.Reason)
+		}
+		time.Sleep(2 * time.Second)
+	}
+}
+
+// resolveExecd resolves the execd endpoint and creates the ExecdClient.
+// Safe for concurrent use — uses mutex with retry on failure.
+func (s *Sandbox) resolveExecd(ctx context.Context) error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if s.execd != nil {
+		return nil
+	}
+
+	useProxy := s.config.UseServerProxy
+	endpoint, err := s.lifecycle.GetEndpoint(ctx, s.id, DefaultExecdPort, &useProxy)
+	if err != nil {
+		return err
+	}
+
+	execdURL := endpoint.Endpoint
+	if !strings.HasPrefix(execdURL, "http") {
+		execdURL = s.config.GetProtocol() + "://" + execdURL
+	}
+
+	token := ""
+	var extraHeaders map[string]string
+	if endpoint.Headers != nil {
+		token = endpoint.Headers["X-EXECD-ACCESS-TOKEN"]
+		// Preserve all endpoint headers (e.g. routing headers) except the auth token
+		extraHeaders = make(map[string]string, len(endpoint.Headers))
+		for k, v := range endpoint.Headers {
+			if k != "X-EXECD-ACCESS-TOKEN" {
+				extraHeaders[k] = v
+			}
+		}
+	}
+	if s.config.UseServerProxy && token == "" {
+		token = s.config.GetAPIKey()
+	}
+
+	s.execd = s.config.execdClient(execdURL, token, extraHeaders)
+	return nil
+}
+
+// resolveEgress resolves the egress endpoint and creates the EgressClient.
+// Safe for concurrent use — uses mutex with retry on failure.
+func (s *Sandbox) resolveEgress(ctx context.Context) error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if s.egress != nil {
+		return nil
+	}
+
+	useProxy := s.config.UseServerProxy
+	endpoint, err := s.lifecycle.GetEndpoint(ctx, s.id, DefaultEgressPort, &useProxy)
+	if err != nil {
+		return err
+	}
+
+	egressURL := endpoint.Endpoint
+	if !strings.HasPrefix(egressURL, "http") {
+		egressURL = s.config.GetProtocol() + "://" + egressURL
+	}
+
+	token := ""
+	var extraHeaders map[string]string
+	if endpoint.Headers != nil {
+		token = endpoint.Headers["OPENSANDBOX-EGRESS-AUTH"]
+		extraHeaders = make(map[string]string, len(endpoint.Headers))
+		for k, v := range endpoint.Headers {
+			if k != "OPENSANDBOX-EGRESS-AUTH" {
+				extraHeaders[k] = v
+			}
+		}
+	}
+
+	s.egress = s.config.egressClient(egressURL, token, extraHeaders)
+	return nil
+}
diff --git a/sdks/sandbox/go/opensandbox/staging_test.go b/sdks/sandbox/go/opensandbox/staging_test.go
new file mode 100644
index 00000000..74ab5a73
--- /dev/null
+++ b/sdks/sandbox/go/opensandbox/staging_test.go
@@ -0,0 +1,197 @@
+//go:build staging
+
+package opensandbox_test
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/alibaba/OpenSandbox/sdks/sandbox/go/opensandbox"
+)
+
+// TestStaging_FullLifecycle tests the Go SDK against the arpi staging server.
+// The staging server differs from local OpenSandbox:
+//   - No /v1/ prefix (routes at /sandboxes directly)
+//   - Auth header: X-API-Key (not OPEN-SANDBOX-API-KEY)
+//   - Proxy endpoints use the staging domain, not host.docker.internal
+//
+// Run: STAGING_URL=https://your-server STAGING_API_KEY=your-key go test -tags staging -run TestStaging -v -timeout 3m
+func TestStaging_FullLifecycle(t *testing.T) {
+	stagingURL := os.Getenv("STAGING_URL")
+	if stagingURL == "" {
+		t.Fatal("STAGING_URL must be set for staging tests")
+	}
+	apiKey := os.Getenv("STAGING_API_KEY")
+	if apiKey == "" {
+		t.Fatal("STAGING_API_KEY must be set for staging tests")
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Minute)
+	defer cancel()
+
+	// Staging uses X-API-Key and no /v1/ prefix
+	client := opensandbox.NewLifecycleClient(stagingURL, apiKey,
+		opensandbox.WithAuthHeader("X-API-Key"))
+
+	// 1. List sandboxes
+	list, err := client.ListSandboxes(ctx, opensandbox.ListOptions{Page: 1, PageSize: 10})
+	if err != nil {
+		t.Fatalf("ListSandboxes: %v", err)
+	}
+	t.Logf("Initial sandbox count: %d", list.Pagination.TotalItems)
+
+	// 2. Create sandbox
+	sb, err := client.CreateSandbox(ctx, opensandbox.CreateSandboxRequest{
+		Image: opensandbox.ImageSpec{
+			URI: "python:3.11-slim",
+		},
+		Entrypoint: []string{"tail", "-f", "/dev/null"},
+		ResourceLimits: map[string]string{
+			"cpu":    "500m",
+			"memory": "256Mi",
+		},
+		Metadata: map[string]string{
+			"test": "staging-go-sdk",
+		},
+	})
+	if err != nil {
+		t.Fatalf("CreateSandbox: %v", err)
+	}
+	t.Logf("Created sandbox: %s (state: %s)", sb.ID, sb.Status.State)
+
+	if sb.ID == "" {
+		t.Fatal("Sandbox ID is empty")
+	}
+
+	defer func() {
+		t.Log("Cleaning up: deleting sandbox")
+		_ = client.DeleteSandbox(context.Background(), sb.ID)
+	}()
+
+	// 3. Wait for Running
+	var running *opensandbox.SandboxInfo
+	for i := 0; i < 60; i++ {
+		running, err = client.GetSandbox(ctx, sb.ID)
+		if err != nil {
+			t.Fatalf("GetSandbox: %v", err)
+		}
+		t.Logf("  Poll %d: state=%s", i+1, running.Status.State)
+		if running.Status.State == opensandbox.StateRunning {
+			break
+		}
+		if running.Status.State == opensandbox.StateFailed || running.Status.State == opensandbox.StateTerminated {
+			t.Fatalf("Sandbox entered terminal state: %s (reason: %s, message: %s)",
+				running.Status.State, running.Status.Reason, running.Status.Message)
+		}
+		time.Sleep(2 * time.Second)
+	}
+	if running == nil || running.Status.State != opensandbox.StateRunning {
+		t.Fatal("Sandbox did not reach Running state within timeout")
+	}
+	t.Logf("Sandbox is Running: %s", running.ID)
+
+	// 4. Get execd endpoint (use server proxy — pod IPs aren't reachable externally)
+	useProxy := true
+	endpoint, err := client.GetEndpoint(ctx, sb.ID, 44772, &useProxy)
+	if err != nil {
+		t.Fatalf("GetEndpoint(44772): %v", err)
+	}
+	t.Logf("Execd endpoint: %s", endpoint.Endpoint)
+
+	// Normalize URL
+	execdURL := endpoint.Endpoint
+	if !strings.HasPrefix(execdURL, "http") {
+		execdURL = "https://" + execdURL
+	}
+	t.Logf("Normalized execd URL: %s", execdURL)
+
+	// 5. Execd ping — proxy requires same API key as lifecycle
+	execToken := apiKey
+	if endpoint.Headers != nil {
+		if v, ok := endpoint.Headers["X-EXECD-ACCESS-TOKEN"]; ok {
+			execToken = v
+		}
+	}
+	execClient := opensandbox.NewExecdClient(execdURL, execToken,
+		opensandbox.WithAuthHeader("X-API-Key"))
+
+	if err := execClient.Ping(ctx); err != nil {
+		t.Fatalf("Execd Ping: %v", err)
+	}
+	t.Log("Execd ping: OK")
+
+	// 6. Run command with SSE
+	var output strings.Builder
+	err = execClient.RunCommand(ctx, opensandbox.RunCommandRequest{
+		Command: "echo hello-from-staging && uname -a",
+	}, func(event opensandbox.StreamEvent) error {
+		t.Logf("  SSE event: type=%s data=%s", event.Event, event.Data)
+		output.WriteString(event.Data)
+		return nil
+	})
+	if err != nil {
+		t.Fatalf("RunCommand: %v", err)
+	}
+	t.Logf("Command raw output (%d bytes): %q", output.Len(), output.String())
+
+	if output.Len() == 0 {
+		t.Error("Expected non-empty command output")
+	}
+
+	// 7. File info
+	fileInfoMap, err := execClient.GetFileInfo(ctx, "/etc/os-release")
+	if err != nil {
+		t.Fatalf("GetFileInfo: %v", err)
+	}
+	for path, fi := range fileInfoMap {
+		t.Logf("File info: path=%s size=%d", path, fi.Size)
+	}
+
+	// 8. Metrics
+	metrics, err := execClient.GetMetrics(ctx)
+	if err != nil {
+		t.Fatalf("GetMetrics: %v", err)
+	}
+	t.Logf("Metrics: cpu_count=%.0f mem_total=%.0fMiB", metrics.CPUCount, metrics.MemTotalMB)
+
+	// 9. Egress (may not be available)
+	egressEndpoint, err := client.GetEndpoint(ctx, sb.ID, 18080, &useProxy)
+	if err != nil {
+		t.Logf("GetEndpoint(egress/18080): %v (skipping egress tests)", err)
+	} else {
+		egressURL := egressEndpoint.Endpoint
+		if !strings.HasPrefix(egressURL, "http") {
+			egressURL = "https://" + egressURL
+		}
+		egressToken := ""
+		if egressEndpoint.Headers != nil {
+			egressToken = egressEndpoint.Headers["OPENSANDBOX-EGRESS-AUTH"]
+		}
+		egressClient := opensandbox.NewEgressClient(egressURL, egressToken)
+		policy, err := egressClient.GetPolicy(ctx)
+		if err != nil {
+			t.Logf("GetPolicy: %v (egress sidecar may not be ready)", err)
+		} else {
+			t.Logf("Egress policy: mode=%s rules=%d", policy.Mode, len(policy.Policy.Egress))
+		}
+	}
+
+	// 10. Delete
+	if err := client.DeleteSandbox(ctx, sb.ID); err != nil {
+		t.Fatalf("DeleteSandbox: %v", err)
+	}
+	t.Log("Sandbox deleted")
+
+	// 11. Verify deletion
+	_, err = client.GetSandbox(ctx, sb.ID)
+	if err != nil {
+		t.Logf("GetSandbox after delete: %v (expected)", err)
+	}
+
+	fmt.Println("\n=== STAGING INTEGRATION TEST PASSED ===")
+	fmt.Println("Full lifecycle on remote staging: create → poll → execd ping → run command (SSE) → file info → metrics → delete")
+}
diff --git a/sdks/sandbox/go/opensandbox/streaming.go b/sdks/sandbox/go/opensandbox/streaming.go
new file mode 100644
index 00000000..81d56968
--- /dev/null
+++ b/sdks/sandbox/go/opensandbox/streaming.go
@@ -0,0 +1,154 @@
+package opensandbox
+
+import (
+	"bufio"
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"strings"
+)
+
+// StreamEvent represents a single Server-Sent Event received from the server.
+type StreamEvent struct {
+	// Event is the event type (e.g. "stdout", "stderr", "result").
+	// Empty string means no explicit event type was set.
+	Event string
+
+	// Data is the event payload. Multiple data lines are joined with newlines.
+	Data string
+
+	// ID is the optional event identifier sent by the server.
+	ID string
+}
+
+// EventHandler is a callback invoked for each SSE event received from the
+// server. Return a non-nil error to stop processing the stream.
+type EventHandler func(event StreamEvent) error
+
+// streamSSE reads Server-Sent Events from resp and calls handler for each
+// complete event. It respects ctx cancellation and closes resp.Body on return.
+func streamSSE(ctx context.Context, resp *http.Response, handler EventHandler) error {
+	defer resp.Body.Close()
+
+	scanner := bufio.NewScanner(resp.Body)
+	// Increase scanner buffer from default 64KiB to 4MiB to handle large SSE data lines.
+	scanner.Buffer(make([]byte, 64*1024), 4*1024*1024)
+
+	var current StreamEvent
+	var dataLines []string
+
+	for {
+		select {
+		case <-ctx.Done():
+			return ctx.Err()
+		default:
+		}
+
+		if !scanner.Scan() {
+			// Stream ended. Dispatch any pending event.
+			if len(dataLines) > 0 {
+				current.Data = strings.Join(dataLines, "\n")
+				if err := handler(current); err != nil {
+					return err
+				}
+			}
+			if err := scanner.Err(); err != nil {
+				return fmt.Errorf("opensandbox: sse read: %w", err)
+			}
+			return nil
+		}
+
+		line := scanner.Text()
+
+		// Empty line signals end of an event block.
+		if line == "" {
+			if len(dataLines) > 0 {
+				current.Data = strings.Join(dataLines, "\n")
+				if err := handler(current); err != nil {
+					return err
+				}
+			}
+			// Reset for next event.
+			current = StreamEvent{}
+			dataLines = nil
+			continue
+		}
+
+		// Comment lines (starting with ':') are ignored per SSE spec.
+		if strings.HasPrefix(line, ":") {
+			continue
+		}
+
+		// NDJSON support: if a line starts with '{', treat it as a raw JSON
+		// event. The execd server writes raw JSON blobs separated by blank
+		// lines instead of standard SSE "data:" prefixed lines.
+		if strings.HasPrefix(line, "{") {
+			dataLines = append(dataLines, line)
+			// Extract "type" field to populate Event so downstream handlers
+			// that switch on event.Event work consistently for NDJSON streams.
+			var probe struct{ Type string }
+			if json.Unmarshal([]byte(line), &probe) == nil && probe.Type != "" {
+				current.Event = probe.Type
+			}
+			continue
+		}
+
+		// Parse "field: value" or "field:value".
+		field, value, _ := strings.Cut(line, ":")
+		// Per SSE spec, if there is a space after the colon, remove it.
+		value = strings.TrimPrefix(value, " ")
+
+		switch field {
+		case "data":
+			dataLines = append(dataLines, value)
+		case "event":
+			current.Event = value
+		case "id":
+			current.ID = value
+		}
+	}
+}
+
+// doStreamRequest builds an HTTP request, executes it, and streams SSE events
+// through handler. It is a helper used by ExecdClient for SSE endpoints.
+func (c *Client) doStreamRequest(ctx context.Context, method, path string, body any, handler EventHandler) error {
+	var bodyReader io.Reader
+	if body != nil {
+		buf, err := json.Marshal(body)
+		if err != nil {
+			return fmt.Errorf("opensandbox: marshal request: %w", err)
+		}
+		bodyReader = bytes.NewReader(buf)
+	}
+
+	req, err := http.NewRequestWithContext(ctx, method, c.baseURL+path, bodyReader)
+	if err != nil {
+		return fmt.Errorf("opensandbox: create request: %w", err)
+	}
+
+	for k, v := range c.headers {
+		req.Header.Set(k, v)
+	}
+	if c.apiKey != "" {
+		req.Header.Set(c.authHeader, c.apiKey)
+	}
+	if body != nil {
+		req.Header.Set("Content-Type", "application/json")
+	}
+	req.Header.Set("Accept", "text/event-stream")
+
+	resp, err := c.httpClient.Do(req)
+	if err != nil {
+		return fmt.Errorf("opensandbox: do request: %w", err)
+	}
+
+	if resp.StatusCode >= 400 {
+		defer resp.Body.Close()
+		return handleError(resp)
+	}
+
+	return streamSSE(ctx, resp, handler)
+}
diff --git a/sdks/sandbox/go/opensandbox/types.go b/sdks/sandbox/go/opensandbox/types.go
new file mode 100644
index 00000000..9cb0999d
--- /dev/null
+++ b/sdks/sandbox/go/opensandbox/types.go
@@ -0,0 +1,314 @@
+// Package opensandbox provides Go client libraries for the OpenSandbox
+// Lifecycle, Egress, and Execd APIs.
+//
+// Lifecycle types are generated from OpenAPI specifications using oapi-codegen.
+// Run `make generate` or `go generate ./...` to regenerate after spec changes.
+package opensandbox
+
+import "time"
+
+// ---------------------------------------------------------------------------
+// Lifecycle types (generated from sandbox-lifecycle.yml via type aliases)
+// ---------------------------------------------------------------------------
+
+// Note: the generated client is at opensandbox/api/lifecycle/ and can be
+// used directly for consumers who prefer the raw generated interface.
+// These aliases provide the ergonomic public API.
+
+// SandboxState represents the high-level lifecycle state of a sandbox.
+type SandboxState string
+
+const (
+	StatePending    SandboxState = "Pending"
+	StateRunning    SandboxState = "Running"
+	StatePausing    SandboxState = "Pausing"
+	StatePaused     SandboxState = "Paused"
+	StateStopping   SandboxState = "Stopping"
+	StateTerminated SandboxState = "Terminated"
+	StateFailed     SandboxState = "Failed"
+)
+
+// SandboxStatus provides detailed status information with lifecycle state
+// and transition details.
+type SandboxStatus struct {
+	State            SandboxState `json:"state"`
+	Reason           string       `json:"reason,omitempty"`
+	Message          string       `json:"message,omitempty"`
+	LastTransitionAt *time.Time   `json:"lastTransitionAt,omitempty"`
+}
+
+// ImageSpec describes the container image used to provision a sandbox.
+type ImageSpec struct {
+	URI  string     `json:"uri"`
+	Auth *ImageAuth `json:"auth,omitempty"`
+}
+
+// ImageAuth holds registry authentication credentials for private images.
+type ImageAuth struct {
+	Username string `json:"username"`
+	Password string `json:"password"`
+}
+
+// ResourceLimits defines runtime resource constraints as key-value pairs.
+// Common keys: "cpu" (e.g. "500m"), "memory" (e.g. "512Mi"), "gpu" (e.g. "1").
+type ResourceLimits map[string]string
+
+// Volume defines a storage mount for a sandbox.
+type Volume struct {
+	Name      string `json:"name"`
+	Host      *Host  `json:"host,omitempty"`
+	PVC       *PVC   `json:"pvc,omitempty"`
+	OSSFS     *OSSFS `json:"ossfs,omitempty"`
+	MountPath string `json:"mountPath"`
+	ReadOnly  bool   `json:"readOnly,omitempty"`
+	SubPath   string `json:"subPath,omitempty"`
+}
+
+// Host represents a host path bind mount backend.
+type Host struct {
+	Path string `json:"path"`
+}
+
+// PVC represents a platform-managed named volume backend.
+type PVC struct {
+	ClaimName string `json:"claimName"`
+}
+
+// OSSFS represents an Alibaba Cloud OSS mount backend via ossfs.
+type OSSFS struct {
+	Bucket          string   `json:"bucket"`
+	Endpoint        string   `json:"endpoint"`
+	Version         string   `json:"version,omitempty"`
+	Options         []string `json:"options,omitempty"`
+	AccessKeyID     string   `json:"accessKeyId"`
+	AccessKeySecret string   `json:"accessKeySecret"`
+}
+
+// NetworkPolicy defines the egress network policy for a sandbox.
+type NetworkPolicy struct {
+	DefaultAction string        `json:"defaultAction,omitempty"`
+	Egress        []NetworkRule `json:"egress,omitempty"`
+}
+
+// NetworkRule defines a single egress allow/deny rule.
+type NetworkRule struct {
+	Action string `json:"action"`
+	Target string `json:"target"`
+}
+
+// CreateSandboxRequest is the request body for creating a new sandbox.
+type CreateSandboxRequest struct {
+	Image          ImageSpec         `json:"image"`
+	Timeout        *int              `json:"timeout,omitempty"`
+	ResourceLimits ResourceLimits    `json:"resourceLimits"`
+	Env            map[string]string `json:"env,omitempty"`
+	Metadata       map[string]string `json:"metadata,omitempty"`
+	Entrypoint     []string          `json:"entrypoint"`
+	NetworkPolicy  *NetworkPolicy    `json:"networkPolicy,omitempty"`
+	Volumes        []Volume          `json:"volumes,omitempty"`
+	Extensions     map[string]string `json:"extensions,omitempty"`
+}
+
+// SandboxInfo represents a runtime execution environment provisioned from a
+// container image, as returned by the lifecycle API.
+type SandboxInfo struct {
+	ID         string            `json:"id"`
+	Image      *ImageSpec        `json:"image,omitempty"`
+	Status     SandboxStatus     `json:"status"`
+	Metadata   map[string]string `json:"metadata,omitempty"`
+	Entrypoint []string          `json:"entrypoint"`
+	ExpiresAt  *time.Time        `json:"expiresAt,omitempty"`
+	CreatedAt  time.Time         `json:"createdAt"`
+}
+
+// PaginationInfo contains pagination metadata for list responses.
+type PaginationInfo struct {
+	Page        int  `json:"page"`
+	PageSize    int  `json:"pageSize"`
+	TotalItems  int  `json:"totalItems"`
+	TotalPages  int  `json:"totalPages"`
+	HasNextPage bool `json:"hasNextPage"`
+}
+
+// ListSandboxesResponse is the paginated response from listing sandboxes.
+type ListSandboxesResponse struct {
+	Items      []SandboxInfo  `json:"items"`
+	Pagination PaginationInfo `json:"pagination"`
+}
+
+// Endpoint describes a public access endpoint for a service running inside
+// a sandbox.
+type Endpoint struct {
+	Endpoint string            `json:"endpoint"`
+	Headers  map[string]string `json:"headers,omitempty"`
+}
+
+// RenewExpirationRequest is the request body for renewing sandbox expiration.
+type RenewExpirationRequest struct {
+	ExpiresAt time.Time `json:"expiresAt"`
+}
+
+// RenewExpirationResponse is the response from renewing sandbox expiration.
+type RenewExpirationResponse struct {
+	ExpiresAt time.Time `json:"expiresAt"`
+}
+
+// ---------------------------------------------------------------------------
+// Egress types (hand-written — egress spec types use *string which hurts
+// ergonomics; the generated client is at opensandbox/api/egress/)
+// ---------------------------------------------------------------------------
+
+// PolicyStatusResponse is the response from the egress policy endpoints.
+type PolicyStatusResponse struct {
+	Status          string         `json:"status,omitempty"`
+	Mode            string         `json:"mode,omitempty"`
+	EnforcementMode string         `json:"enforcementMode,omitempty"`
+	Reason          string         `json:"reason,omitempty"`
+	Policy          *NetworkPolicy `json:"policy,omitempty"`
+}
+
+// ---------------------------------------------------------------------------
+// Error types
+// ---------------------------------------------------------------------------
+
+// ErrorResponse is the standard error response for non-2xx HTTP responses.
+type ErrorResponse struct {
+	Code    string `json:"code"`
+	Message string `json:"message"`
+}
+
+// APIError wraps an ErrorResponse with the HTTP status code.
+type APIError struct {
+	StatusCode int
+	RequestID  string
+	Response   ErrorResponse
+}
+
+// Error implements the error interface.
+func (e *APIError) Error() string {
+	return e.Response.Code + ": " + e.Response.Message
+}
+
+// ---------------------------------------------------------------------------
+// Execd types (hand-written — execd endpoints use SSE streaming, multipart
+// upload, and text responses not representable in generated client)
+// ---------------------------------------------------------------------------
+
+// CodeContext represents a code execution context with session identifier.
+type CodeContext struct {
+	ID       string `json:"id,omitempty"`
+	Language string `json:"language"`
+}
+
+// CreateContextRequest is the request body for creating a code execution context.
+type CreateContextRequest struct {
+	Language string `json:"language"`
+}
+
+// RunCodeRequest is the request body for executing code in a context.
+type RunCodeRequest struct {
+	Context *CodeContext `json:"context,omitempty"`
+	Code    string       `json:"code"`
+}
+
+// Session represents a bash session with a unique identifier.
+type Session struct {
+	ID string `json:"session_id"`
+}
+
+// CreateSessionRequest is the optional request body for creating a bash session.
+type CreateSessionRequest struct {
+	Cwd string `json:"cwd,omitempty"`
+}
+
+// RunCommandRequest is the request body for executing a shell command.
+type RunCommandRequest struct {
+	Command    string            `json:"command"`
+	Cwd        string            `json:"cwd,omitempty"`
+	Background bool              `json:"background,omitempty"`
+	Timeout    int64             `json:"timeout,omitempty"`
+	UID        *int32            `json:"uid,omitempty"`
+	GID        *int32            `json:"gid,omitempty"`
+	Envs       map[string]string `json:"envs,omitempty"`
+}
+
+// RunInSessionRequest is the request body for running a command in an existing bash session.
+type RunInSessionRequest struct {
+	Command string `json:"command"`
+	Cwd     string `json:"cwd,omitempty"`
+	Timeout int64  `json:"timeout,omitempty"`
+}
+
+// CommandStatusResponse contains the status of a command execution.
+type CommandStatusResponse struct {
+	ID         string     `json:"id"`
+	Content    string     `json:"content"`
+	Running    bool       `json:"running"`
+	ExitCode   *int32     `json:"exit_code,omitempty"`
+	Error      string     `json:"error,omitempty"`
+	StartedAt  time.Time  `json:"started_at"`
+	FinishedAt *time.Time `json:"finished_at,omitempty"`
+}
+
+// CommandLogsResponse contains the stdout/stderr output and cursor for
+// incremental log polling.
+type CommandLogsResponse struct {
+	Output string
+	Cursor int64
+}
+
+// FileInfo contains file metadata including path and permissions.
+type FileInfo struct {
+	Path       string    `json:"path"`
+	Size       int64     `json:"size"`
+	ModifiedAt time.Time `json:"modified_at"`
+	CreatedAt  time.Time `json:"created_at"`
+	Owner      string    `json:"owner"`
+	Group      string    `json:"group"`
+	Mode       int       `json:"mode"`
+}
+
+// Permission defines file ownership and mode settings.
+type Permission struct {
+	Owner string `json:"owner,omitempty"`
+	Group string `json:"group,omitempty"`
+	Mode  int    `json:"mode"`
+}
+
+// PermissionsRequest maps file paths to their desired permission settings.
+type PermissionsRequest map[string]Permission
+
+// MoveItem defines a single file move/rename operation.
+type MoveItem struct {
+	Src  string `json:"src"`
+	Dest string `json:"dest"`
+}
+
+// MoveRequest is a list of file move/rename operations.
+type MoveRequest []MoveItem
+
+// ReplaceItem defines a text replacement operation for a single file.
+type ReplaceItem struct {
+	Old string `json:"old"`
+	New string `json:"new"`
+}
+
+// ReplaceRequest maps file paths to their replacement operations.
+type ReplaceRequest map[string]ReplaceItem
+
+// FileMetadata is the metadata sent alongside file uploads.
+type FileMetadata struct {
+	Path  string `json:"path"`
+	Owner string `json:"owner,omitempty"`
+	Group string `json:"group,omitempty"`
+	Mode  int    `json:"mode,omitempty"`
+}
+
+// Metrics contains system resource usage metrics.
+type Metrics struct {
+	CPUCount   float64 `json:"cpu_count"`
+	CPUUsedPct float64 `json:"cpu_used_pct"`
+	MemTotalMB float64 `json:"mem_total_mib"`
+	MemUsedMB  float64 `json:"mem_used_mib"`
+	Timestamp  int64   `json:"timestamp"`
+}
diff --git a/tests/go/go.mod b/tests/go/go.mod
new file mode 100644
index 00000000..edef57a2
--- /dev/null
+++ b/tests/go/go.mod
@@ -0,0 +1,7 @@
+module github.com/alibaba/OpenSandbox/tests/go
+
+go 1.24.0
+
+require github.com/alibaba/OpenSandbox/sdks/sandbox/go v0.0.0
+
+replace github.com/alibaba/OpenSandbox/sdks/sandbox/go => ../../sdks/sandbox/go
diff --git a/tests/go/tests/base_e2e_test.go b/tests/go/tests/base_e2e_test.go
new file mode 100644
index 00000000..09d9b826
--- /dev/null
+++ b/tests/go/tests/base_e2e_test.go
@@ -0,0 +1,71 @@
+//go:build e2e
+
+package tests
+
+import (
+	"context"
+	"os"
+	"testing"
+	"time"
+
+	"github.com/alibaba/OpenSandbox/sdks/sandbox/go/opensandbox"
+)
+
+func getConnectionConfig(t *testing.T) opensandbox.ConnectionConfig {
+	t.Helper()
+
+	domain := os.Getenv("OPENSANDBOX_TEST_DOMAIN")
+	if domain == "" {
+		domain = "localhost:8080"
+	}
+
+	protocol := os.Getenv("OPENSANDBOX_TEST_PROTOCOL")
+	if protocol == "" {
+		protocol = "http"
+	}
+
+	apiKey := os.Getenv("OPENSANDBOX_TEST_API_KEY")
+	if apiKey == "" {
+		apiKey = "e2e-test"
+	}
+
+	useProxy := os.Getenv("OPENSANDBOX_TEST_USE_SERVER_PROXY") == "true"
+
+	config := opensandbox.ConnectionConfig{
+		Domain:         domain,
+		Protocol:       protocol,
+		APIKey:         apiKey,
+		UseServerProxy: useProxy,
+	}
+
+	// Override auth header if using server proxy (staging setups use X-API-Key)
+	if useProxy {
+		config.AuthHeader = "X-API-Key"
+	}
+
+	return config
+}
+
+func getSandboxImage() string {
+	if img := os.Getenv("OPENSANDBOX_SANDBOX_DEFAULT_IMAGE"); img != "" {
+		return img
+	}
+	return "python:3.11-slim"
+}
+
+// createTestSandbox creates a sandbox with default settings and registers cleanup.
+func createTestSandbox(t *testing.T) (context.Context, *opensandbox.Sandbox) {
+	t.Helper()
+	config := getConnectionConfig(t)
+	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Minute)
+	t.Cleanup(cancel)
+
+	sb, err := opensandbox.CreateSandbox(ctx, config, opensandbox.SandboxCreateOptions{
+		Image: getSandboxImage(),
+	})
+	if err != nil {
+		t.Fatalf("CreateSandbox: %v", err)
+	}
+	t.Cleanup(func() { sb.Kill(context.Background()) })
+	return ctx, sb
+}
diff --git a/tests/go/tests/code_interpreter_e2e_test.go b/tests/go/tests/code_interpreter_e2e_test.go
new file mode 100644
index 00000000..5f98e0f4
--- /dev/null
+++ b/tests/go/tests/code_interpreter_e2e_test.go
@@ -0,0 +1,192 @@
+//go:build e2e
+
+package tests
+
+import (
+	"context"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/alibaba/OpenSandbox/sdks/sandbox/go/opensandbox"
+)
+
+func createCodeInterpreter(t *testing.T) (context.Context, *opensandbox.CodeInterpreter) {
+	t.Helper()
+	config := getConnectionConfig(t)
+	ctx, cancel := context.WithTimeout(context.Background(), 3*time.Minute)
+	t.Cleanup(cancel)
+
+	ci, err := opensandbox.CreateCodeInterpreter(ctx, config, opensandbox.CodeInterpreterCreateOptions{
+		Metadata: map[string]string{
+			"test": "go-e2e-code-interpreter",
+		},
+		ReadyTimeout:        60 * time.Second,
+		HealthCheckInterval: 500 * time.Millisecond,
+	})
+	if err != nil {
+		t.Fatalf("CreateCodeInterpreter: %v", err)
+	}
+	t.Cleanup(func() { ci.Kill(context.Background()) })
+	return ctx, ci
+}
+
+func TestCodeInterpreter_CreateAndPing(t *testing.T) {
+	ctx, ci := createCodeInterpreter(t)
+
+	if !ci.IsHealthy(ctx) {
+		t.Error("Code interpreter should be healthy")
+	}
+
+	metrics, err := ci.GetMetrics(ctx)
+	if err != nil {
+		t.Fatalf("GetMetrics: %v", err)
+	}
+	t.Logf("Code interpreter metrics: cpu=%.0f, mem=%.0fMiB", metrics.CPUCount, metrics.MemTotalMB)
+}
+
+func TestCodeInterpreter_PythonExecution(t *testing.T) {
+	ctx, ci := createCodeInterpreter(t)
+
+	exec, err := ci.Execute(ctx, "python", `print("hello from python")`, nil)
+	if err != nil {
+		t.Fatalf("Execute python: %v", err)
+	}
+
+	text := exec.Text()
+	if !strings.Contains(text, "hello from python") {
+		t.Errorf("Expected python output, got: %q", text)
+	}
+	t.Logf("Python output: %s", text)
+}
+
+func TestCodeInterpreter_PythonContextPersistence(t *testing.T) {
+	ctx, ci := createCodeInterpreter(t)
+
+	// Create a context
+	codeCtx, err := ci.CreateContext(ctx, opensandbox.CreateContextRequest{Language: "python"})
+	if err != nil {
+		t.Fatalf("CreateContext: %v", err)
+	}
+	t.Logf("Created context: %s", codeCtx.ID)
+
+	// Set a variable
+	exec, err := ci.ExecuteInContext(ctx, codeCtx.ID, "python", `x = 42`, nil)
+	if err != nil {
+		t.Fatalf("Execute (set var): %v", err)
+	}
+	_ = exec
+
+	// Read variable back — should persist in context
+	exec, err = ci.ExecuteInContext(ctx, codeCtx.ID, "python", `print(f"x is {x}")`, nil)
+	if err != nil {
+		t.Fatalf("Execute (read var): %v", err)
+	}
+
+	text := exec.Text()
+	if !strings.Contains(text, "x is 42") {
+		t.Errorf("Expected variable persistence, got: %q", text)
+	}
+	t.Logf("Context persistence: %s", text)
+
+	// Cleanup
+	err = ci.DeleteContext(ctx, codeCtx.ID)
+	if err != nil {
+		t.Logf("DeleteContext: %v", err)
+	}
+}
+
+func TestCodeInterpreter_ContextManagement(t *testing.T) {
+	ctx, ci := createCodeInterpreter(t)
+
+	// Create context
+	codeCtx, err := ci.CreateContext(ctx, opensandbox.CreateContextRequest{Language: "python"})
+	if err != nil {
+		t.Fatalf("CreateContext: %v", err)
+	}
+
+	// List contexts
+	contexts, err := ci.ListContexts(ctx, "python")
+	if err != nil {
+		t.Fatalf("ListContexts: %v", err)
+	}
+	if len(contexts) == 0 {
+		t.Error("Expected at least one context")
+	}
+	t.Logf("Listed %d python contexts", len(contexts))
+
+	// Delete context
+	err = ci.DeleteContext(ctx, codeCtx.ID)
+	if err != nil {
+		t.Fatalf("DeleteContext: %v", err)
+	}
+	t.Log("Context management passed")
+}
+
+func TestCodeInterpreter_ContextIsolation(t *testing.T) {
+	config := getConnectionConfig(t)
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
+	defer cancel()
+
+	ci, err := opensandbox.CreateCodeInterpreter(ctx, config, opensandbox.CodeInterpreterCreateOptions{
+		ReadyTimeout:        60 * time.Second,
+		HealthCheckInterval: 500 * time.Millisecond,
+	})
+	if err != nil {
+		t.Fatalf("CreateCodeInterpreter: %v", err)
+	}
+	defer ci.Kill(context.Background())
+
+	// Create two contexts
+	ctx1, err := ci.CreateContext(ctx, opensandbox.CreateContextRequest{Language: "python"})
+	if err != nil {
+		t.Fatalf("CreateContext 1: %v", err)
+	}
+	ctx2, err := ci.CreateContext(ctx, opensandbox.CreateContextRequest{Language: "python"})
+	if err != nil {
+		t.Fatalf("CreateContext 2: %v", err)
+	}
+
+	// Set variable in context 1
+	ci.ExecuteInContext(ctx, ctx1.ID, "python", `isolated_var = "ctx1_only"`, nil)
+
+	// Try to read it in context 2 — should get NameError
+	exec, err := ci.ExecuteInContext(ctx, ctx2.ID, "python", `print("ISOLATED") if "isolated_var" not in dir() else print(isolated_var)`, nil)
+	if err != nil {
+		t.Fatalf("Execute in ctx2: %v", err)
+	}
+
+	text := exec.Text()
+	if !strings.Contains(text, "ISOLATED") {
+		t.Errorf("Contexts should be isolated, got: %q", text)
+	}
+	t.Log("Context isolation verified")
+
+	ci.DeleteContext(ctx, ctx1.ID)
+	ci.DeleteContext(ctx, ctx2.ID)
+}
+
+func TestCodeInterpreter_ExecutionWithHandlers(t *testing.T) {
+	ctx, ci := createCodeInterpreter(t)
+
+	var stdoutLines []string
+	handlers := &opensandbox.ExecutionHandlers{
+		OnStdout: func(msg opensandbox.OutputMessage) error {
+			stdoutLines = append(stdoutLines, msg.Text)
+			return nil
+		},
+	}
+
+	_, err := ci.Execute(ctx, "python", `
+for i in range(3):
+    print(f"line {i}")
+`, handlers)
+	if err != nil {
+		t.Fatalf("Execute with handlers: %v", err)
+	}
+
+	if len(stdoutLines) == 0 {
+		t.Error("Expected handler to receive stdout")
+	}
+	t.Logf("Handler received %d stdout events", len(stdoutLines))
+}
diff --git a/tests/go/tests/command_e2e_test.go b/tests/go/tests/command_e2e_test.go
new file mode 100644
index 00000000..953db032
--- /dev/null
+++ b/tests/go/tests/command_e2e_test.go
@@ -0,0 +1,147 @@
+//go:build e2e
+
+package tests
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/alibaba/OpenSandbox/sdks/sandbox/go/opensandbox"
+)
+
+func TestCommand_RunSimple(t *testing.T) {
+	ctx, sb := createTestSandbox(t)
+
+	exec, err := sb.RunCommand(ctx, "echo hello-from-go-e2e", nil)
+	if err != nil {
+		t.Fatalf("RunCommand: %v", err)
+	}
+
+	if exec.ExitCode == nil || *exec.ExitCode != 0 {
+		t.Errorf("Expected exit code 0, got %v", exec.ExitCode)
+	}
+
+	text := exec.Text()
+	if !strings.Contains(text, "hello-from-go-e2e") {
+		t.Errorf("Expected stdout to contain 'hello-from-go-e2e', got: %q", text)
+	}
+	t.Logf("Output: %s", text)
+}
+
+func TestCommand_RunWithHandlers(t *testing.T) {
+	ctx, sb := createTestSandbox(t)
+
+	var stdoutLines []string
+	handlers := &opensandbox.ExecutionHandlers{
+		OnStdout: func(msg opensandbox.OutputMessage) error {
+			stdoutLines = append(stdoutLines, msg.Text)
+			return nil
+		},
+	}
+
+	exec, err := sb.RunCommand(ctx, "echo line1 && echo line2", handlers)
+	if err != nil {
+		t.Fatalf("RunCommand: %v", err)
+	}
+
+	if len(stdoutLines) == 0 {
+		t.Error("Expected handler to receive stdout events")
+	}
+	t.Logf("Handler received %d stdout events", len(stdoutLines))
+	t.Logf("Execution stdout count: %d", len(exec.Stdout))
+}
+
+func TestCommand_ExitCode(t *testing.T) {
+	ctx, sb := createTestSandbox(t)
+
+	exec, err := sb.RunCommand(ctx, "true", nil)
+	if err != nil {
+		t.Fatalf("RunCommand(true): %v", err)
+	}
+	if exec.ExitCode == nil || *exec.ExitCode != 0 {
+		t.Errorf("Expected exit code 0 for 'true', got %v", exec.ExitCode)
+	}
+	t.Log("Exit code tests passed")
+}
+
+func TestCommand_MultiLine(t *testing.T) {
+	ctx, sb := createTestSandbox(t)
+
+	exec, err := sb.RunCommand(ctx, "echo hello && echo world && uname -a", nil)
+	if err != nil {
+		t.Fatalf("RunCommand: %v", err)
+	}
+
+	text := exec.Text()
+	if !strings.Contains(text, "hello") || !strings.Contains(text, "world") {
+		t.Errorf("Expected multi-line output, got: %q", text)
+	}
+	t.Logf("Multi-line output (%d bytes): %s", len(text), text)
+}
+
+func TestCommand_EnvInjection(t *testing.T) {
+	ctx, sb := createTestSandbox(t)
+
+	exec, err := sb.RunCommandWithOpts(ctx, opensandbox.RunCommandRequest{
+		Command: "echo $CUSTOM_VAR",
+		Envs: map[string]string{
+			"CUSTOM_VAR": "injected-from-go-e2e",
+		},
+	}, nil)
+	if err != nil {
+		t.Fatalf("RunCommand with envs: %v", err)
+	}
+
+	text := exec.Text()
+	if !strings.Contains(text, "injected-from-go-e2e") {
+		t.Errorf("Expected env var in output, got: %q", text)
+	}
+	t.Logf("Env injection: %s", text)
+}
+
+func TestCommand_BackgroundStatusLogs(t *testing.T) {
+	ctx, sb := createTestSandbox(t)
+
+	// Run a background command
+	exec, err := sb.RunCommandWithOpts(ctx, opensandbox.RunCommandRequest{
+		Command:    "echo bg-output && sleep 1 && echo bg-done",
+		Background: true,
+	}, nil)
+	if err != nil {
+		t.Fatalf("RunCommand background: %v", err)
+	}
+
+	// The init event should give us an execution ID
+	if exec.ID == "" {
+		t.Log("No execution ID from background command (server may not return init event for background)")
+		return
+	}
+	t.Logf("Background command ID: %s", exec.ID)
+}
+
+func TestCommand_Interrupt(t *testing.T) {
+	ctx, sb := createTestSandbox(t)
+
+	// Start a long-running command in background
+	exec, err := sb.RunCommandWithOpts(ctx, opensandbox.RunCommandRequest{
+		Command:    "sleep 300",
+		Background: true,
+	}, nil)
+	if err != nil {
+		t.Fatalf("RunCommand background: %v", err)
+	}
+	if exec.ID == "" {
+		t.Log("No execution ID — cannot test interrupt")
+		return
+	}
+
+	// Verify it's running — try a quick command to confirm sandbox is responsive
+	pingExec, err := sb.RunCommand(ctx, "echo still-alive", nil)
+	if err != nil {
+		t.Fatalf("Ping after background: %v", err)
+	}
+	if !strings.Contains(pingExec.Text(), "still-alive") {
+		t.Error("Sandbox should still be responsive")
+	}
+	t.Log("Interrupt test: sandbox responsive during background command")
+}
diff --git a/tests/go/tests/concurrent_e2e_test.go b/tests/go/tests/concurrent_e2e_test.go
new file mode 100644
index 00000000..1f60ab24
--- /dev/null
+++ b/tests/go/tests/concurrent_e2e_test.go
@@ -0,0 +1,92 @@
+//go:build e2e
+
+package tests
+
+import (
+	"context"
+	"fmt"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/alibaba/OpenSandbox/sdks/sandbox/go/opensandbox"
+)
+
+func TestConcurrent_CreateFiveSandboxes(t *testing.T) {
+	config := getConnectionConfig(t)
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
+	defer cancel()
+
+	const count = 5
+	var wg sync.WaitGroup
+	sandboxes := make([]*opensandbox.Sandbox, count)
+	errors := make([]error, count)
+
+	t.Logf("Creating %d sandboxes concurrently...", count)
+	start := time.Now()
+
+	for i := 0; i < count; i++ {
+		wg.Add(1)
+		go func(idx int) {
+			defer wg.Done()
+			sb, err := opensandbox.CreateSandbox(ctx, config, opensandbox.SandboxCreateOptions{
+				Image: getSandboxImage(),
+				Metadata: map[string]string{
+					"test":  "go-e2e-concurrent",
+					"index": fmt.Sprintf("%d", idx),
+				},
+			})
+			sandboxes[idx] = sb
+			errors[idx] = err
+		}(i)
+	}
+	wg.Wait()
+	elapsed := time.Since(start)
+
+	// Cleanup all sandboxes
+	defer func() {
+		for _, sb := range sandboxes {
+			if sb != nil {
+				sb.Kill(context.Background())
+			}
+		}
+	}()
+
+	// Check results
+	succeeded := 0
+	for i := 0; i < count; i++ {
+		if errors[i] != nil {
+			t.Logf("Sandbox %d failed: %v", i, errors[i])
+		} else {
+			succeeded++
+			t.Logf("Sandbox %d: %s (healthy=%v)", i, sandboxes[i].ID(), sandboxes[i].IsHealthy(ctx))
+		}
+	}
+
+	t.Logf("Created %d/%d sandboxes in %s", succeeded, count, elapsed.Round(time.Millisecond))
+	// Allow some failures on resource-constrained staging clusters
+	minRequired := 3
+	if succeeded < minRequired {
+		t.Fatalf("Expected at least %d/%d sandboxes to succeed, only %d did", minRequired, count, succeeded)
+	}
+
+	// Run a command on each to verify they're independent
+	var cmdWg sync.WaitGroup
+	for i := 0; i < count; i++ {
+		if sandboxes[i] == nil {
+			continue
+		}
+		cmdWg.Add(1)
+		go func(idx int) {
+			defer cmdWg.Done()
+			exec, err := sandboxes[idx].RunCommand(ctx, fmt.Sprintf("echo sandbox-%d", idx), nil)
+			if err != nil {
+				t.Errorf("Command on sandbox %d failed: %v", idx, err)
+				return
+			}
+			t.Logf("Sandbox %d output: %s", idx, exec.Text())
+		}(i)
+	}
+	cmdWg.Wait()
+	t.Log("All concurrent sandboxes created, verified, and responding independently")
+}
diff --git a/tests/go/tests/error_handling_e2e_test.go b/tests/go/tests/error_handling_e2e_test.go
new file mode 100644
index 00000000..b0e8aeee
--- /dev/null
+++ b/tests/go/tests/error_handling_e2e_test.go
@@ -0,0 +1,46 @@
+//go:build e2e
+
+package tests
+
+import (
+	"context"
+	"errors"
+	"testing"
+	"time"
+
+	"github.com/alibaba/OpenSandbox/sdks/sandbox/go/opensandbox"
+)
+
+func TestError_XRequestIDPassthrough(t *testing.T) {
+	config := getConnectionConfig(t)
+	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
+	defer cancel()
+
+	mgr := opensandbox.NewSandboxManager(config)
+	defer mgr.Close()
+
+	// Request a non-existent sandbox — server should return 404 with x-request-id
+	_, err := mgr.GetSandboxInfo(ctx, "non-existent-sandbox-id-12345")
+	if err == nil {
+		t.Fatal("Expected error for non-existent sandbox")
+	}
+
+	var apiErr *opensandbox.APIError
+	if !errors.As(err, &apiErr) {
+		t.Fatalf("Expected *APIError, got %T: %v", err, err)
+	}
+
+	if apiErr.StatusCode != 404 {
+		t.Errorf("Expected 404, got %d", apiErr.StatusCode)
+	}
+
+	// x-request-id should be present on server errors
+	if apiErr.RequestID != "" {
+		t.Logf("x-request-id present: %s (status=%d, code=%s)",
+			apiErr.RequestID, apiErr.StatusCode, apiErr.Response.Code)
+	} else {
+		t.Log("x-request-id not returned by server (may not be configured)")
+	}
+
+	t.Logf("Error response: code=%s message=%s", apiErr.Response.Code, apiErr.Response.Message)
+}
diff --git a/tests/go/tests/filesystem_e2e_test.go b/tests/go/tests/filesystem_e2e_test.go
new file mode 100644
index 00000000..e7f22d28
--- /dev/null
+++ b/tests/go/tests/filesystem_e2e_test.go
@@ -0,0 +1,156 @@
+//go:build e2e
+
+package tests
+
+import (
+	"io"
+	"strings"
+	"testing"
+
+	"github.com/alibaba/OpenSandbox/sdks/sandbox/go/opensandbox"
+)
+
+func TestFilesystem_GetFileInfo(t *testing.T) {
+	ctx, sb := createTestSandbox(t)
+
+	info, err := sb.GetFileInfo(ctx, "/etc/os-release")
+	if err != nil {
+		t.Fatalf("GetFileInfo: %v", err)
+	}
+
+	fi, ok := info["/etc/os-release"]
+	if !ok {
+		t.Fatal("Expected /etc/os-release in result")
+	}
+	if fi.Size == 0 {
+		t.Error("Expected non-zero file size")
+	}
+	t.Logf("File info: path=%s size=%d owner=%s", fi.Path, fi.Size, fi.Owner)
+}
+
+func TestFilesystem_WriteReadDelete(t *testing.T) {
+	ctx, sb := createTestSandbox(t)
+
+	// Write via command
+	exec, err := sb.RunCommand(ctx, `echo "go-e2e-content" > /tmp/test-rw.txt`, nil)
+	if err != nil {
+		t.Fatalf("Write: %v", err)
+	}
+	if exec.ExitCode != nil && *exec.ExitCode != 0 {
+		t.Fatalf("Write exit code: %d", *exec.ExitCode)
+	}
+
+	// Read back via command
+	exec, err = sb.RunCommand(ctx, "cat /tmp/test-rw.txt", nil)
+	if err != nil {
+		t.Fatalf("Read: %v", err)
+	}
+	if !strings.Contains(exec.Text(), "go-e2e-content") {
+		t.Errorf("Expected content, got: %q", exec.Text())
+	}
+
+	// GetFileInfo
+	info, err := sb.GetFileInfo(ctx, "/tmp/test-rw.txt")
+	if err != nil {
+		t.Fatalf("GetFileInfo: %v", err)
+	}
+	if _, ok := info["/tmp/test-rw.txt"]; !ok {
+		t.Fatal("File not found via GetFileInfo")
+	}
+
+	// Delete
+	err = sb.DeleteFiles(ctx, []string{"/tmp/test-rw.txt"})
+	if err != nil {
+		t.Fatalf("DeleteFiles: %v", err)
+	}
+
+	// Verify deleted
+	exec, err = sb.RunCommand(ctx, "test -f /tmp/test-rw.txt && echo exists || echo gone", nil)
+	if err != nil {
+		t.Fatalf("Verify: %v", err)
+	}
+	if !strings.Contains(exec.Text(), "gone") {
+		t.Errorf("File should be deleted, got: %q", exec.Text())
+	}
+	t.Log("Write/Read/Delete cycle passed")
+}
+
+func TestFilesystem_MoveFiles(t *testing.T) {
+	ctx, sb := createTestSandbox(t)
+
+	// Create source file
+	sb.RunCommand(ctx, `echo "move-me" > /tmp/move-src.txt`, nil)
+
+	// Move
+	err := sb.MoveFiles(ctx, opensandbox.MoveRequest{
+		{Src: "/tmp/move-src.txt", Dest: "/tmp/move-dst.txt"},
+	})
+	if err != nil {
+		t.Fatalf("MoveFiles: %v", err)
+	}
+
+	// Verify destination exists
+	exec, err := sb.RunCommand(ctx, "cat /tmp/move-dst.txt", nil)
+	if err != nil {
+		t.Fatalf("Read moved file: %v", err)
+	}
+	if !strings.Contains(exec.Text(), "move-me") {
+		t.Errorf("Moved file content mismatch: %q", exec.Text())
+	}
+	t.Log("MoveFiles passed")
+}
+
+func TestFilesystem_Directories(t *testing.T) {
+	ctx, sb := createTestSandbox(t)
+
+	// Create directory
+	err := sb.CreateDirectory(ctx, "/tmp/test-dir-e2e", 755)
+	if err != nil {
+		t.Fatalf("CreateDirectory: %v", err)
+	}
+
+	// Verify exists
+	exec, err := sb.RunCommand(ctx, "test -d /tmp/test-dir-e2e && echo yes || echo no", nil)
+	if err != nil {
+		t.Fatalf("Verify dir: %v", err)
+	}
+	if !strings.Contains(exec.Text(), "yes") {
+		t.Error("Directory should exist")
+	}
+
+	// Delete directory
+	err = sb.DeleteDirectory(ctx, "/tmp/test-dir-e2e")
+	if err != nil {
+		t.Fatalf("DeleteDirectory: %v", err)
+	}
+	t.Log("Directory create/delete passed")
+}
+
+func TestFilesystem_SearchFiles(t *testing.T) {
+	ctx, sb := createTestSandbox(t)
+
+	results, err := sb.SearchFiles(ctx, "/etc", "*.conf")
+	if err != nil {
+		t.Fatalf("SearchFiles: %v", err)
+	}
+	t.Logf("Found %d files matching *.conf in /etc", len(results))
+}
+
+func TestFilesystem_DownloadFile(t *testing.T) {
+	ctx, sb := createTestSandbox(t)
+
+	rc, err := sb.DownloadFile(ctx, "/etc/os-release", "")
+	if err != nil {
+		t.Fatalf("DownloadFile: %v", err)
+	}
+	defer rc.Close()
+
+	data, err := io.ReadAll(rc)
+	if err != nil {
+		t.Fatalf("Read download: %v", err)
+	}
+	if len(data) == 0 {
+		t.Error("Downloaded file is empty")
+	}
+	t.Logf("Downloaded %d bytes", len(data))
+}
diff --git a/tests/go/tests/manager_e2e_test.go b/tests/go/tests/manager_e2e_test.go
new file mode 100644
index 00000000..2bdb946d
--- /dev/null
+++ b/tests/go/tests/manager_e2e_test.go
@@ -0,0 +1,105 @@
+//go:build e2e
+
+package tests
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/alibaba/OpenSandbox/sdks/sandbox/go/opensandbox"
+)
+
+func TestManager_ListSandboxes(t *testing.T) {
+	config := getConnectionConfig(t)
+	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	defer cancel()
+
+	mgr := opensandbox.NewSandboxManager(config)
+	defer mgr.Close()
+
+	result, err := mgr.ListSandboxInfos(ctx, opensandbox.ListOptions{
+		Page:     1,
+		PageSize: 10,
+	})
+	if err != nil {
+		t.Fatalf("ListSandboxInfos: %v", err)
+	}
+
+	t.Logf("Listed %d sandboxes (page %d/%d)",
+		len(result.Items), result.Pagination.Page, result.Pagination.TotalPages)
+}
+
+func TestManager_ListByState(t *testing.T) {
+	config := getConnectionConfig(t)
+	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Minute)
+	defer cancel()
+
+	// Create a sandbox to ensure there's at least one Running
+	sb, err := opensandbox.CreateSandbox(ctx, config, opensandbox.SandboxCreateOptions{
+		Image: getSandboxImage(),
+		Metadata: map[string]string{
+			"test": "go-e2e-manager",
+		},
+	})
+	if err != nil {
+		t.Fatalf("CreateSandbox: %v", err)
+	}
+	defer sb.Kill(context.Background())
+
+	mgr := opensandbox.NewSandboxManager(config)
+	defer mgr.Close()
+
+	// Filter by Running state
+	result, err := mgr.ListSandboxInfos(ctx, opensandbox.ListOptions{
+		States: []opensandbox.SandboxState{opensandbox.StateRunning},
+	})
+	if err != nil {
+		t.Fatalf("ListSandboxInfos(Running): %v", err)
+	}
+
+	if len(result.Items) == 0 {
+		t.Error("Expected at least one Running sandbox")
+	}
+
+	// Verify all returned sandboxes are Running
+	for _, item := range result.Items {
+		if item.Status.State != opensandbox.StateRunning {
+			t.Errorf("Expected Running state, got %s for sandbox %s", item.Status.State, item.ID)
+		}
+	}
+	t.Logf("Found %d Running sandboxes", len(result.Items))
+}
+
+func TestManager_GetAndKill(t *testing.T) {
+	config := getConnectionConfig(t)
+	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Minute)
+	defer cancel()
+
+	// Create via high-level API
+	sb, err := opensandbox.CreateSandbox(ctx, config, opensandbox.SandboxCreateOptions{
+		Image: getSandboxImage(),
+	})
+	if err != nil {
+		t.Fatalf("CreateSandbox: %v", err)
+	}
+
+	mgr := opensandbox.NewSandboxManager(config)
+	defer mgr.Close()
+
+	// Get via manager
+	info, err := mgr.GetSandboxInfo(ctx, sb.ID())
+	if err != nil {
+		t.Fatalf("GetSandboxInfo: %v", err)
+	}
+	if info.ID != sb.ID() {
+		t.Errorf("ID mismatch: got %s, want %s", info.ID, sb.ID())
+	}
+	t.Logf("Got sandbox %s via manager (state=%s)", info.ID, info.Status.State)
+
+	// Kill via manager
+	if err := mgr.KillSandbox(ctx, sb.ID()); err != nil {
+		t.Fatalf("KillSandbox: %v", err)
+	}
+	t.Log("Killed sandbox via manager")
+}
diff --git a/tests/go/tests/sandbox_e2e_test.go b/tests/go/tests/sandbox_e2e_test.go
new file mode 100644
index 00000000..2b84dcb5
--- /dev/null
+++ b/tests/go/tests/sandbox_e2e_test.go
@@ -0,0 +1,289 @@
+//go:build e2e
+
+package tests
+
+import (
+	"context"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/alibaba/OpenSandbox/sdks/sandbox/go/opensandbox"
+)
+
+func TestSandbox_CreateAndKill(t *testing.T) {
+	config := getConnectionConfig(t)
+	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Minute)
+	defer cancel()
+
+	sb, err := opensandbox.CreateSandbox(ctx, config, opensandbox.SandboxCreateOptions{
+		Image:      getSandboxImage(),
+		Entrypoint: []string{"tail", "-f", "/dev/null"},
+		ResourceLimits: opensandbox.ResourceLimits{
+			"cpu":    "500m",
+			"memory": "256Mi",
+		},
+		Metadata: map[string]string{
+			"test": "go-e2e-create",
+		},
+	})
+	if err != nil {
+		t.Fatalf("CreateSandbox: %v", err)
+	}
+	t.Logf("Created sandbox: %s", sb.ID())
+
+	defer func() {
+		if err := sb.Kill(context.Background()); err != nil {
+			t.Logf("Kill cleanup: %v", err)
+		}
+	}()
+
+	if !sb.IsHealthy(ctx) {
+		t.Error("Sandbox should be healthy after creation")
+	}
+
+	info, err := sb.GetInfo(ctx)
+	if err != nil {
+		t.Fatalf("GetInfo: %v", err)
+	}
+	if info.ID != sb.ID() {
+		t.Errorf("ID mismatch: got %s, want %s", info.ID, sb.ID())
+	}
+	if info.Status.State != opensandbox.StateRunning {
+		t.Errorf("Expected Running state, got %s", info.Status.State)
+	}
+	t.Logf("Info: state=%s, created=%s", info.Status.State, info.CreatedAt)
+
+	metrics, err := sb.GetMetrics(ctx)
+	if err != nil {
+		t.Fatalf("GetMetrics: %v", err)
+	}
+	if metrics.CPUCount == 0 {
+		t.Error("Expected non-zero CPU count")
+	}
+	t.Logf("Metrics: cpu=%.0f, mem=%.0fMiB", metrics.CPUCount, metrics.MemTotalMB)
+
+	if err := sb.Kill(ctx); err != nil {
+		t.Fatalf("Kill: %v", err)
+	}
+	t.Log("Sandbox killed successfully")
+}
+
+func TestSandbox_Renew(t *testing.T) {
+	ctx, sb := createTestSandbox(t)
+
+	_, err := sb.Renew(ctx, 30*time.Minute)
+	if err != nil {
+		t.Logf("Renew: %v (may not be supported)", err)
+	} else {
+		t.Log("Renewed expiration: +30m")
+	}
+}
+
+func TestSandbox_GetEndpoint(t *testing.T) {
+	ctx, sb := createTestSandbox(t)
+
+	endpoint, err := sb.GetEndpoint(ctx, opensandbox.DefaultExecdPort)
+	if err != nil {
+		t.Fatalf("GetEndpoint: %v", err)
+	}
+	if endpoint.Endpoint == "" {
+		t.Error("Expected non-empty endpoint")
+	}
+	t.Logf("Endpoint: %s", endpoint.Endpoint)
+}
+
+func TestSandbox_ConnectToExisting(t *testing.T) {
+	config := getConnectionConfig(t)
+	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Minute)
+	defer cancel()
+
+	sb1, err := opensandbox.CreateSandbox(ctx, config, opensandbox.SandboxCreateOptions{
+		Image: getSandboxImage(),
+	})
+	if err != nil {
+		t.Fatalf("CreateSandbox: %v", err)
+	}
+	defer sb1.Kill(context.Background())
+
+	sb2, err := opensandbox.ConnectSandbox(ctx, config, sb1.ID(), opensandbox.ReadyOptions{})
+	if err != nil {
+		t.Fatalf("ConnectSandbox: %v", err)
+	}
+
+	if sb2.ID() != sb1.ID() {
+		t.Errorf("IDs should match: %s vs %s", sb1.ID(), sb2.ID())
+	}
+
+	exec, err := sb2.RunCommand(ctx, "echo connected", nil)
+	if err != nil {
+		t.Fatalf("RunCommand via connected sandbox: %v", err)
+	}
+	if !strings.Contains(exec.Text(), "connected") {
+		t.Errorf("Expected 'connected' in output, got: %q", exec.Text())
+	}
+	t.Log("ConnectSandbox works")
+}
+
+func TestSandbox_Session(t *testing.T) {
+	ctx, sb := createTestSandbox(t)
+
+	session, err := sb.CreateSession(ctx)
+	if err != nil {
+		t.Fatalf("CreateSession: %v", err)
+	}
+	t.Logf("Created session: %s", session.ID)
+
+	sb.RunInSession(ctx, session.ID, opensandbox.RunInSessionRequest{
+		Command: "export MY_VAR=hello_session",
+	}, nil)
+
+	exec, err := sb.RunInSession(ctx, session.ID, opensandbox.RunInSessionRequest{
+		Command: "echo $MY_VAR",
+	}, nil)
+	if err != nil {
+		t.Fatalf("RunInSession (read var): %v", err)
+	}
+	if !strings.Contains(exec.Text(), "hello_session") {
+		t.Errorf("Session state not preserved, got: %q", exec.Text())
+	}
+	t.Log("Session state persists across commands")
+
+	err = sb.DeleteSession(ctx, session.ID)
+	if err != nil {
+		t.Fatalf("DeleteSession: %v", err)
+	}
+	t.Log("Session deleted")
+}
+
+func TestSandbox_ManualCleanup(t *testing.T) {
+	config := getConnectionConfig(t)
+	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Minute)
+	defer cancel()
+
+	// Create with no timeout (manual cleanup)
+	sb, err := opensandbox.CreateSandbox(ctx, config, opensandbox.SandboxCreateOptions{
+		Image: getSandboxImage(),
+	})
+	if err != nil {
+		t.Fatalf("CreateSandbox: %v", err)
+	}
+	defer sb.Kill(context.Background())
+
+	info, err := sb.GetInfo(ctx)
+	if err != nil {
+		t.Fatalf("GetInfo: %v", err)
+	}
+	t.Logf("Sandbox %s created (expiresAt=%v)", info.ID, info.ExpiresAt)
+}
+
+func TestSandbox_NetworkPolicyCreate(t *testing.T) {
+	config := getConnectionConfig(t)
+	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Minute)
+	defer cancel()
+
+	sb, err := opensandbox.CreateSandbox(ctx, config, opensandbox.SandboxCreateOptions{
+		Image: getSandboxImage(),
+		NetworkPolicy: &opensandbox.NetworkPolicy{
+			DefaultAction: "deny",
+			Egress: []opensandbox.NetworkRule{
+				{Action: "allow", Target: "pypi.org"},
+				{Action: "allow", Target: "*.python.org"},
+			},
+		},
+	})
+	if err != nil {
+		// Server may require egress.image config for network policies
+		t.Skipf("CreateSandbox with NetworkPolicy: %v (egress sidecar may not be configured)", err)
+	}
+	defer sb.Kill(context.Background())
+
+	// Verify sandbox is running
+	if !sb.IsHealthy(ctx) {
+		t.Error("Sandbox with network policy should be healthy")
+	}
+	t.Log("Sandbox created with deny-default network policy + 2 allow rules")
+}
+
+func TestSandbox_EgressPolicyGetAndPatch(t *testing.T) {
+	ctx, sb := createTestSandbox(t)
+
+	// Get current policy
+	policy, err := sb.GetEgressPolicy(ctx)
+	if err != nil {
+		t.Logf("GetEgressPolicy: %v (egress sidecar may not be available)", err)
+		t.Skip("Egress sidecar not available")
+	}
+	t.Logf("Current policy: mode=%s", policy.Mode)
+
+	// Patch with new rule
+	patched, err := sb.PatchEgressRules(ctx, []opensandbox.NetworkRule{
+		{Action: "allow", Target: "example.com"},
+	})
+	if err != nil {
+		t.Fatalf("PatchEgressRules: %v", err)
+	}
+	t.Logf("Patched policy: mode=%s", patched.Mode)
+}
+
+func TestSandbox_PauseAndResume(t *testing.T) {
+	config := getConnectionConfig(t)
+	ctx, cancel := context.WithTimeout(context.Background(), 3*time.Minute)
+	defer cancel()
+
+	sb, err := opensandbox.CreateSandbox(ctx, config, opensandbox.SandboxCreateOptions{
+		Image: getSandboxImage(),
+	})
+	if err != nil {
+		t.Fatalf("CreateSandbox: %v", err)
+	}
+	defer sb.Kill(context.Background())
+
+	// Pause
+	err = sb.Pause(ctx)
+	if err != nil {
+		t.Logf("Pause: %v (may not be supported by runtime)", err)
+		t.Skip("Pause not supported")
+	}
+	t.Log("Pause requested")
+
+	// Poll until Paused
+	for i := 0; i < 30; i++ {
+		info, err := sb.GetInfo(ctx)
+		if err != nil {
+			t.Fatalf("GetInfo during pause: %v", err)
+		}
+		t.Logf("  Poll %d: state=%s", i+1, info.Status.State)
+		if info.Status.State == opensandbox.StatePaused {
+			t.Log("Sandbox is Paused")
+			break
+		}
+		if info.Status.State == opensandbox.StateFailed {
+			t.Fatalf("Sandbox failed: %s", info.Status.Reason)
+		}
+		time.Sleep(2 * time.Second)
+	}
+
+	// Resume — need to use manager since Sandbox doesn't have Resume yet
+	mgr := opensandbox.NewSandboxManager(config)
+	err = mgr.ResumeSandbox(ctx, sb.ID())
+	if err != nil {
+		t.Fatalf("Resume: %v", err)
+	}
+	t.Log("Resume requested")
+
+	// Poll until Running again
+	for i := 0; i < 30; i++ {
+		info, err := sb.GetInfo(ctx)
+		if err != nil {
+			t.Fatalf("GetInfo during resume: %v", err)
+		}
+		t.Logf("  Poll %d: state=%s", i+1, info.Status.State)
+		if info.Status.State == opensandbox.StateRunning {
+			t.Log("Sandbox is Running again after resume")
+			return
+		}
+		time.Sleep(2 * time.Second)
+	}
+	t.Fatal("Sandbox did not resume to Running state")
+}
diff --git a/tests/go/tests/scenario_agent_e2e_test.go b/tests/go/tests/scenario_agent_e2e_test.go
new file mode 100644
index 00000000..2ed671eb
--- /dev/null
+++ b/tests/go/tests/scenario_agent_e2e_test.go
@@ -0,0 +1,340 @@
+//go:build e2e
+
+package tests
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"os"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/alibaba/OpenSandbox/sdks/sandbox/go/opensandbox"
+)
+
+// getLLMEndpoint returns the Bifrost LLM gateway URL.
+func getLLMEndpoint() string {
+	if v := os.Getenv("LLM_ENDPOINT"); v != "" {
+		return v
+	}
+	// Same domain as sandbox, different path
+	domain := os.Getenv("OPENSANDBOX_TEST_DOMAIN")
+	if domain == "" {
+		return ""
+	}
+	protocol := os.Getenv("OPENSANDBOX_TEST_PROTOCOL")
+	if protocol == "" {
+		protocol = "https"
+	}
+	return fmt.Sprintf("%s://%s/v1", protocol, domain)
+}
+
+func getLLMModel() string {
+	if v := os.Getenv("LLM_MODEL"); v != "" {
+		return v
+	}
+	return "azure/gpt-4o-mini"
+}
+
+// chatCompletion calls the LLM via Bifrost and returns the assistant message.
+func chatCompletion(ctx context.Context, endpoint, model string, messages []map[string]string) (string, error) {
+	body, _ := json.Marshal(map[string]any{
+		"model":      model,
+		"messages":   messages,
+		"max_tokens": 1024,
+	})
+
+	req, err := http.NewRequestWithContext(ctx, "POST", endpoint+"/chat/completions", bytes.NewReader(body))
+	if err != nil {
+		return "", err
+	}
+	req.Header.Set("Content-Type", "application/json")
+
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		return "", err
+	}
+	defer resp.Body.Close()
+
+	data, _ := io.ReadAll(resp.Body)
+	if resp.StatusCode != 200 {
+		return "", fmt.Errorf("LLM returned %d: %s", resp.StatusCode, string(data))
+	}
+
+	var result struct {
+		Choices []struct {
+			Message struct {
+				Content string `json:"content"`
+			} `json:"message"`
+		} `json:"choices"`
+	}
+	if err := json.Unmarshal(data, &result); err != nil {
+		return "", fmt.Errorf("parse LLM response: %w", err)
+	}
+	if len(result.Choices) == 0 {
+		return "", fmt.Errorf("no choices in LLM response")
+	}
+	return result.Choices[0].Message.Content, nil
+}
+
+// extractCode pulls a Python code block from LLM output.
+func extractCode(text string) string {
+	// Look for ```python ... ``` blocks
+	start := strings.Index(text, "```python")
+	if start == -1 {
+		start = strings.Index(text, "```")
+		if start == -1 {
+			return ""
+		}
+		start += 3
+	} else {
+		start += 9
+	}
+	// Skip to next line
+	if nl := strings.Index(text[start:], "\n"); nl != -1 {
+		start += nl + 1
+	}
+	end := strings.Index(text[start:], "```")
+	if end == -1 {
+		return text[start:]
+	}
+	return strings.TrimSpace(text[start : start+end])
+}
+
+// TestScenario_SimpleAgentLoop tests a basic agent that:
+// 1. Gets a task
+// 2. Asks the LLM to write Python code
+// 3. Executes the code in a sandbox
+// 4. Returns the result
+func TestScenario_SimpleAgentLoop(t *testing.T) {
+	llmEndpoint := getLLMEndpoint()
+	if llmEndpoint == "" {
+		t.Skip("LLM_ENDPOINT or OPENSANDBOX_TEST_DOMAIN not set")
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), 3*time.Minute)
+	defer cancel()
+
+	// Create sandbox
+	config := getConnectionConfig(t)
+	sb, err := opensandbox.CreateSandbox(ctx, config, opensandbox.SandboxCreateOptions{
+		Image: getSandboxImage(),
+	})
+	if err != nil {
+		t.Fatalf("CreateSandbox: %v", err)
+	}
+	defer sb.Kill(context.Background())
+	t.Logf("Sandbox ready: %s", sb.ID())
+
+	// Step 1: Ask LLM to write code
+	task := "Write Python code that calculates the first 10 Fibonacci numbers and prints them as a comma-separated list. Only output the code block, nothing else."
+	t.Logf("Task: %s", task)
+
+	llmResponse, err := chatCompletion(ctx, llmEndpoint, getLLMModel(), []map[string]string{
+		{"role": "system", "content": "You are a coding assistant. Respond ONLY with a Python code block. No explanation."},
+		{"role": "user", "content": task},
+	})
+	if err != nil {
+		t.Fatalf("LLM call: %v", err)
+	}
+	t.Logf("LLM response:\n%s", llmResponse)
+
+	// Step 2: Extract code
+	code := extractCode(llmResponse)
+	if code == "" {
+		// Try using the whole response as code
+		code = strings.TrimSpace(llmResponse)
+	}
+	t.Logf("Extracted code:\n%s", code)
+
+	// Step 3: Write code to file and execute in sandbox
+	writeCmd := fmt.Sprintf("cat > /tmp/agent_task.py << 'PYEOF'\n%s\nPYEOF", code)
+	writeResult, writeErr := sb.RunCommand(ctx, writeCmd, nil)
+	if writeErr != nil {
+		t.Fatalf("Write code to sandbox: %v", writeErr)
+	}
+	if writeResult.ExitCode != nil && *writeResult.ExitCode != 0 {
+		t.Fatalf("Write code to sandbox failed with exit code %d: %s", *writeResult.ExitCode, writeResult.Text())
+	}
+	exec, err := sb.RunCommand(ctx, "python3 /tmp/agent_task.py", nil)
+	if err != nil {
+		t.Fatalf("Execute code: %v", err)
+	}
+
+	output := exec.Text()
+	t.Logf("Execution output: %s", output)
+
+	if exec.ExitCode != nil && *exec.ExitCode != 0 {
+		t.Errorf("Code execution failed with exit code %d", *exec.ExitCode)
+	}
+
+	// Step 4: Verify result contains Fibonacci numbers (sequence includes 0,1,1,2,3,5,8,13,21,34)
+	if !strings.Contains(output, "1") || !strings.Contains(output, "8") || !strings.Contains(output, "34") {
+		t.Errorf("Output doesn't look like Fibonacci numbers: %q", output)
+	}
+	t.Log("Agent loop completed successfully: task → LLM → code → execute → result")
+}
+
+// TestScenario_CodeInterpreterAgent tests a multi-turn agent that:
+// 1. Creates a code interpreter sandbox
+// 2. Uses the LLM to solve a data analysis task step-by-step
+// 3. Maintains Python state across multiple code executions
+func TestScenario_CodeInterpreterAgent(t *testing.T) {
+	llmEndpoint := getLLMEndpoint()
+	if llmEndpoint == "" {
+		t.Skip("LLM_ENDPOINT or OPENSANDBOX_TEST_DOMAIN not set")
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
+	defer cancel()
+
+	config := getConnectionConfig(t)
+	ci, err := opensandbox.CreateCodeInterpreter(ctx, config, opensandbox.CodeInterpreterCreateOptions{
+		ReadyTimeout:        60 * time.Second,
+		HealthCheckInterval: 500 * time.Millisecond,
+	})
+	if err != nil {
+		t.Fatalf("CreateCodeInterpreter: %v", err)
+	}
+	defer ci.Kill(context.Background())
+	t.Logf("Code interpreter ready: %s", ci.ID())
+
+	// Create persistent Python context
+	codeCtx, err := ci.CreateContext(ctx, opensandbox.CreateContextRequest{Language: "python"})
+	if err != nil {
+		t.Fatalf("CreateContext: %v", err)
+	}
+	t.Logf("Python context: %s", codeCtx.ID)
+
+	// Agent conversation: multi-turn data analysis
+	conversation := []map[string]string{
+		{"role": "system", "content": "You are a data analysis assistant. When asked to analyze data, respond ONLY with a Python code block. The code will be executed in a Jupyter-like environment where variables persist between turns. Always print your results. Use only the Python standard library — do NOT import numpy, pandas, or any external packages."},
+	}
+
+	// Turn 1: Create dataset
+	t.Log("--- Turn 1: Create dataset ---")
+	conversation = append(conversation, map[string]string{
+		"role": "user", "content": "Create a list called 'sales' with these monthly values: [120, 150, 90, 200, 180, 220, 160, 190, 210, 170, 230, 250]. Print the list.",
+	})
+
+	reply1, err := chatCompletion(ctx, llmEndpoint, getLLMModel(), conversation)
+	if err != nil {
+		t.Fatalf("LLM turn 1: %v", err)
+	}
+	code1 := extractCode(reply1)
+	if code1 == "" {
+		code1 = strings.TrimSpace(reply1)
+	}
+	t.Logf("Turn 1 code: %s", code1)
+
+	exec1, err := ci.ExecuteInContext(ctx, codeCtx.ID, "python", code1, nil)
+	if err != nil {
+		t.Fatalf("Execute turn 1: %v", err)
+	}
+	t.Logf("Turn 1 output: %s", exec1.Text())
+	conversation = append(conversation, map[string]string{"role": "assistant", "content": reply1})
+
+	// Turn 2: Analyze the data (using persisted variable)
+	t.Log("--- Turn 2: Analyze dataset ---")
+	conversation = append(conversation, map[string]string{
+		"role": "user", "content": "Using the 'sales' variable from the previous step, calculate and print: the mean, the max month (1-indexed), and whether total sales exceed 2000.",
+	})
+
+	reply2, err := chatCompletion(ctx, llmEndpoint, getLLMModel(), conversation)
+	if err != nil {
+		t.Fatalf("LLM turn 2: %v", err)
+	}
+	code2 := extractCode(reply2)
+	if code2 == "" {
+		code2 = strings.TrimSpace(reply2)
+	}
+	t.Logf("Turn 2 code: %s", code2)
+
+	exec2, err := ci.ExecuteInContext(ctx, codeCtx.ID, "python", code2, nil)
+	if err != nil {
+		t.Fatalf("Execute turn 2: %v", err)
+	}
+	output2 := exec2.Text()
+	t.Logf("Turn 2 output: %s", output2)
+
+	// Verify the analysis used the persisted state
+	if output2 == "" {
+		t.Error("Turn 2 produced no output — context persistence may have failed")
+	}
+	// The total is 2170, so "exceed 2000" should be True/Yes
+	if !strings.Contains(strings.ToLower(output2), "true") && !strings.Contains(strings.ToLower(output2), "yes") && !strings.Contains(output2, "2170") {
+		t.Logf("Warning: output may not confirm total > 2000: %q", output2)
+	}
+
+	// Cleanup
+	ci.DeleteContext(ctx, codeCtx.ID)
+	t.Log("Multi-turn code interpreter agent completed successfully")
+}
+
+// TestScenario_SandboxToolUse tests an agent that uses the sandbox as a tool:
+// 1. LLM decides what shell command to run
+// 2. Agent executes it in sandbox
+// 3. Returns output to LLM for interpretation
+func TestScenario_SandboxToolUse(t *testing.T) {
+	llmEndpoint := getLLMEndpoint()
+	if llmEndpoint == "" {
+		t.Skip("LLM_ENDPOINT or OPENSANDBOX_TEST_DOMAIN not set")
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), 3*time.Minute)
+	defer cancel()
+
+	config := getConnectionConfig(t)
+	sb, err := opensandbox.CreateSandbox(ctx, config, opensandbox.SandboxCreateOptions{
+		Image: getSandboxImage(),
+	})
+	if err != nil {
+		t.Fatalf("CreateSandbox: %v", err)
+	}
+	defer sb.Kill(context.Background())
+
+	// Ask LLM what command to run to get system info
+	reply, err := chatCompletion(ctx, llmEndpoint, getLLMModel(), []map[string]string{
+		{"role": "system", "content": "You have access to a Linux shell. Respond ONLY with the exact shell command to run. No explanation, no code blocks, just the raw command."},
+		{"role": "user", "content": "What command shows the Linux kernel version, CPU count, and total memory in one line?"},
+	})
+	if err != nil {
+		t.Fatalf("LLM: %v", err)
+	}
+	command := strings.TrimSpace(reply)
+	// Strip code block markers if present
+	command = strings.TrimPrefix(command, "```bash\n")
+	command = strings.TrimPrefix(command, "```\n")
+	command = strings.TrimSuffix(command, "\n```")
+	command = strings.TrimPrefix(command, "```")
+	command = strings.TrimSpace(command)
+	t.Logf("LLM suggested command: %s", command)
+
+	// Execute in sandbox
+	exec, err := sb.RunCommand(ctx, command, nil)
+	if err != nil {
+		t.Fatalf("Execute: %v", err)
+	}
+	shellOutput := exec.Text()
+	t.Logf("Shell output: %s", shellOutput)
+
+	// Ask LLM to interpret the output
+	interpretation, err := chatCompletion(ctx, llmEndpoint, getLLMModel(), []map[string]string{
+		{"role": "system", "content": "Summarize the system information in one sentence."},
+		{"role": "user", "content": fmt.Sprintf("Shell output:\n%s", shellOutput)},
+	})
+	if err != nil {
+		t.Fatalf("LLM interpret: %v", err)
+	}
+	t.Logf("LLM interpretation: %s", interpretation)
+
+	if interpretation == "" {
+		t.Error("LLM produced no interpretation")
+	}
+	t.Log("Tool-use agent completed: task → LLM → shell → LLM → answer")
+}
diff --git a/tests/go/tests/volume_e2e_test.go b/tests/go/tests/volume_e2e_test.go
new file mode 100644
index 00000000..3cf7d8da
--- /dev/null
+++ b/tests/go/tests/volume_e2e_test.go
@@ -0,0 +1,153 @@
+//go:build e2e
+
+package tests
+
+import (
+	"context"
+	"os"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/alibaba/OpenSandbox/sdks/sandbox/go/opensandbox"
+)
+
+func getHostVolumeDir() string {
+	if v := os.Getenv("OPENSANDBOX_TEST_HOST_VOLUME_DIR"); v != "" {
+		return v
+	}
+	return "/tmp/opensandbox-e2e/host-volume-test"
+}
+
+func getPVCName() string {
+	if v := os.Getenv("OPENSANDBOX_TEST_PVC_NAME"); v != "" {
+		return v
+	}
+	return "opensandbox-e2e-pvc-test"
+}
+
+func TestVolume_HostMount(t *testing.T) {
+	config := getConnectionConfig(t)
+	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Minute)
+	defer cancel()
+
+	hostDir := getHostVolumeDir()
+
+	sb, err := opensandbox.CreateSandbox(ctx, config, opensandbox.SandboxCreateOptions{
+		Image:       getSandboxImage(),
+		ReadyTimeout: 60 * time.Second,
+		Volumes: []opensandbox.Volume{
+			{
+				Name:      "test-host-vol",
+				Host:      &opensandbox.Host{Path: hostDir},
+				MountPath: "/mnt/host-data",
+			},
+		},
+	})
+	if err != nil {
+		t.Logf("CreateSandbox with host volume: %v (host volumes may not be allowed)", err)
+		t.Skip("Host volume mount not supported in this environment")
+	}
+	defer sb.Kill(context.Background())
+
+	// Write a file to the mounted volume
+	exec, err := sb.RunCommand(ctx, `echo "host-mount-test" > /mnt/host-data/go-e2e.txt`, nil)
+	if err != nil {
+		t.Fatalf("Write to host mount: %v", err)
+	}
+	if exec.ExitCode != nil && *exec.ExitCode != 0 {
+		t.Fatalf("Write exit code: %d", *exec.ExitCode)
+	}
+
+	// Read it back
+	exec, err = sb.RunCommand(ctx, "cat /mnt/host-data/go-e2e.txt", nil)
+	if err != nil {
+		t.Fatalf("Read from host mount: %v", err)
+	}
+	if !strings.Contains(exec.Text(), "host-mount-test") {
+		t.Errorf("Expected content from host mount, got: %q", exec.Text())
+	}
+	t.Log("Host volume mount read/write passed")
+}
+
+func TestVolume_HostMountReadOnly(t *testing.T) {
+	config := getConnectionConfig(t)
+	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Minute)
+	defer cancel()
+
+	hostDir := getHostVolumeDir()
+
+	sb, err := opensandbox.CreateSandbox(ctx, config, opensandbox.SandboxCreateOptions{
+		Image: getSandboxImage(),
+		Volumes: []opensandbox.Volume{
+			{
+				Name:      "test-host-ro",
+				Host:      &opensandbox.Host{Path: hostDir},
+				MountPath: "/mnt/host-ro",
+				ReadOnly:  true,
+			},
+		},
+	})
+	if err != nil {
+		t.Logf("CreateSandbox with ro host volume: %v", err)
+		t.Skip("Host volume mount not supported")
+	}
+	defer sb.Kill(context.Background())
+
+	// Writing to read-only mount should fail
+	exec, err := sb.RunCommand(ctx, `echo "should-fail" > /mnt/host-ro/fail.txt 2>&1; echo "EXIT_CODE=$?"`, nil)
+	if err != nil {
+		t.Fatalf("Write to ro mount: %v", err)
+	}
+	output := exec.Text()
+	if strings.Contains(output, "EXIT_CODE=0") {
+		t.Fatal("Write to read-only mount unexpectedly succeeded (exit code 0)")
+	}
+	if !strings.Contains(output, "Read-only") && !strings.Contains(output, "read-only") && !strings.Contains(output, "Permission denied") && !strings.Contains(output, "permission denied") {
+		t.Fatalf("Expected read-only or permission denied error, got: %q", output)
+	}
+	t.Log("Host volume read-only mount verified")
+}
+
+func TestVolume_PVCMount(t *testing.T) {
+	config := getConnectionConfig(t)
+	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Minute)
+	defer cancel()
+
+	pvcName := getPVCName()
+
+	sb, err := opensandbox.CreateSandbox(ctx, config, opensandbox.SandboxCreateOptions{
+		Image: getSandboxImage(),
+		Volumes: []opensandbox.Volume{
+			{
+				Name:      "test-pvc-vol",
+				PVC:       &opensandbox.PVC{ClaimName: pvcName},
+				MountPath: "/mnt/pvc-data",
+			},
+		},
+	})
+	if err != nil {
+		t.Logf("CreateSandbox with PVC: %v (PVC %s may not exist)", err, pvcName)
+		t.Skip("PVC volume mount not available")
+	}
+	defer sb.Kill(context.Background())
+
+	// Write to PVC
+	exec, err := sb.RunCommand(ctx, `echo "pvc-test-data" > /mnt/pvc-data/go-e2e.txt`, nil)
+	if err != nil {
+		t.Fatalf("Write to PVC: %v", err)
+	}
+	if exec.ExitCode != nil && *exec.ExitCode != 0 {
+		t.Fatalf("Write exit code: %d", *exec.ExitCode)
+	}
+
+	// Read back
+	exec, err = sb.RunCommand(ctx, "cat /mnt/pvc-data/go-e2e.txt", nil)
+	if err != nil {
+		t.Fatalf("Read from PVC: %v", err)
+	}
+	if !strings.Contains(exec.Text(), "pvc-test-data") {
+		t.Errorf("Expected PVC content, got: %q", exec.Text())
+	}
+	t.Log("PVC volume mount read/write passed")
+}