feat(sandbox): publish E2B and Cube Session files

README.md

@@ -96,7 +96,7 @@ make local-down
 | Core resources | Agent, Environment, and Session lifecycle, versioning, filtering, and pagination |
 | Events and runtime | Messages, interrupts, custom-tool results, confirmations, outcomes, retries, SSE, and durable park/resume |
 | Tools | Sandbox built-ins, provider-native Web Search/Fetch, and remote MCP tools with optional Vault-backed bearer authentication |
-| Files | Object-backed File lifecycle, reusable outcome rubrics, File-backed Session Resources, and idle-boundary publication of Docker/OpenSandbox/Daytona `/mnt/session/outputs` deliverables |
+| Files | Object-backed File lifecycle, reusable outcome rubrics, File-backed Session Resources, and idle-boundary publication of Docker and remote-sandbox `/mnt/session/outputs` deliverables |
 | Skills | Custom Skill lifecycle, immutable Version pins, and on-demand instruction loading in Docker Sessions |
 | Memory | Store, Memory, and immutable Version lifecycle; durable read/write or read-only Docker mounts at `/mnt/memory` |
 | Vaults | Encrypted Vault and Credential lifecycle plus ordered Session attachment, live OAuth validation, and automatic token refresh; environment-variable egress remains in progress |

docs/api/files.md

@@ -79,7 +79,7 @@ tool results remain unsupported.
 
 ## Session outputs
 
-The output directory is writable inside Docker, OpenSandbox, and Daytona
+The output directory is writable inside Docker, E2B, CubeSandbox, OpenSandbox, and Daytona
 sandboxes. At every primary Session idle boundary, the worker recursively
 streams its regular files into the configured object store before committing
 `session.status_idle`. A client that observes the idle event can therefore
@@ -102,15 +102,17 @@ usable, allowing a later turn to remove or replace the invalid entry. An
 explicit interrupt skips output publication so cancellation is not delayed by
 a large snapshot.
 
-Publishing requires configured Files storage and a Docker, OpenSandbox, or
-Daytona sandbox. OpenSandbox and Daytona stream a temporary archive through
-their provider SDK; the selected remote image must contain `tar`. Publishing
-is not enabled for the CMA `self_hosted` Environment mode, where the client
-owns tool execution, nor for local-process, E2B, or Cube sandboxes. A text-only
-Session that never provisioned a sandbox does not create one merely to check
-for outputs. A durable Docker sandbox created before the output mount was
-introduced fails closed and must be recreated; it is never treated as an empty
-output tree.
+Publishing requires configured Files storage and a Docker, E2B, CubeSandbox,
+OpenSandbox, or Daytona sandbox. Remote adapters create a temporary archive
+through their provider SDK; the selected remote image must contain `tar`.
+OpenSandbox and Daytona stream that archive, while the current E2B/Cube Go data
+plane buffers the complete archive in worker memory before Mango validates and
+publishes it. Publishing is not enabled for the CMA `self_hosted` Environment
+mode, where the client owns tool execution, nor for local-process sandboxes. A
+text-only Session that never provisioned a sandbox does not create one merely
+to check for outputs. A durable Docker sandbox created before the output mount
+was introduced fails closed and must be recreated; it is never treated as an
+empty output tree.
 
 ## Lifecycle and limits
 

docs/api/session-resources.md

@@ -20,10 +20,11 @@ DELETE /v1/sessions/{session_id}/resources/{resource_id}
 
 A File attachment creates an independent downloadable copy scoped to the
 Session. An explicit path is normalized beneath `/mnt/session/uploads`.
-Docker exposes that path read-only. OpenSandbox and Daytona materialize a
-writable sandbox-local copy as a current backend limitation; changing it does
-not change the S3-backed source or downloadable Session File. Write a modified
-deliverable beneath `/mnt/session/outputs` when output publication is available.
+Docker exposes that path read-only. E2B, CubeSandbox, OpenSandbox, and Daytona
+materialize a writable sandbox-local copy as a current backend limitation;
+changing it does not change the S3-backed source or downloadable Session File.
+Write a modified deliverable beneath `/mnt/session/outputs` when output
+publication is available.
 Deleting the source upload does not break the copy. Detach the Session Resource
 to delete it from the sandbox.
 
@@ -40,11 +41,12 @@ removed after Session creation.
 
 ## Availability
 
-File mounts currently require a cloud Environment backed by Docker,
-OpenSandbox, or Daytona. E2B and Cube remain fail-closed because their pinned
-Go data-plane client buffers uploads and does not satisfy Mango's 500 MB
-streaming path. Memory mounts require Docker. GitHub repository resources and
-update-time repository token rotation are not implemented; unsupported
-variants return an explicit `422`.
+File mounts currently require a cloud Environment backed by Docker, E2B,
+CubeSandbox, OpenSandbox, or Daytona. The pinned E2B/Cube-compatible Go client
+uses whole-value file methods, so those two adapters buffer each File Resource
+in worker memory during materialization and retain provider-default file modes;
+their provider-side copy is also writable. Memory mounts require Docker. GitHub
+repository resources and update-time repository token rotation are not
+implemented; unsupported variants return an explicit `422`.
 
 See [Files](files.md) and [Memory](memory.md).

docs/api/sessions.md

@@ -119,12 +119,13 @@ corresponding Docker sandbox capability is configured:
 ```
 
 Each attachment creates an independent, downloadable Session-scoped File copy
-beneath `/mnt/session/uploads`. Docker presents it read-only; OpenSandbox and
-Daytona currently expose a writable sandbox-local copy. A Memory Store input
+beneath `/mnt/session/uploads`. Docker presents it read-only; E2B, CubeSandbox,
+OpenSandbox, and Daytona currently expose a writable sandbox-local copy. A Memory Store input
 uses `type: "memory_store"`, `memory_store_id`, optional `instructions`, and
 `read_write` or `read_only` access; it is mounted beneath `/mnt/memory` and can
-only be attached at creation. GitHub repository, self-hosted Environment,
-local-process, E2B, and Cube resources return `422`.
+only be attached at creation. GitHub repository, self-hosted Environment, and
+local-process resources return `422`. E2B and Cube accept File resources but
+currently buffer each copy in worker memory during materialization.
 `vault_ids` is an ordered list of active Vault references. The order is frozen
 with the Session: for an MCP endpoint, the first Vault containing a matching
 credential wins. Admission requires the Vault keyring to be configured and
@@ -256,8 +257,8 @@ resumes a turn that was paused at that check.
 `deployment_id` is null for direct Session creation and contains the parent
 Deployment ID for Deployment-created Sessions.
 
-For Mango-managed Docker, OpenSandbox, and Daytona Sessions with Files storage
-configured, regular files written beneath `/mnt/session/outputs` are published
+For Mango-managed Docker, E2B, CubeSandbox, OpenSandbox, and Daytona Sessions
+with Files storage configured, regular files written beneath `/mnt/session/outputs` are published
 before the Session becomes idle. List them with
 `GET /v1/files?scope_id={session_id}` and download them through the Files
 content endpoint. See [Files](files.md#session-outputs) for limits and provider

docs/architecture/storage-context-and-tools.md

@@ -203,16 +203,18 @@ Session-scoped File object and records a durable desired mount.
 Before each sandbox tool execution a capable adapter ensures that the requested
 identity exists beneath `/mnt/session/uploads`. Docker streams into
 provider-owned staging, verifies size and SHA-256, atomically publishes it, and
-exposes the staging directory read-only. OpenSandbox and Daytona stream through
-their official SDK clients and record an identity marker after validation; the
-current remote copies are writable and sandbox-local edits do not update the
-S3-backed Session File. Deletion records a tombstone until the worker removes
-the applied copy. Local, E2B, and Cube adapters reject the feature.
-
-Docker, OpenSandbox, and Daytona expose a writable
+exposes the staging directory read-only. Remote adapters use their official SDK
+clients and record an identity marker after validation; OpenSandbox and Daytona
+stream the transfer, while E2B and Cube buffer each complete File in worker
+memory. The current remote copies are writable and sandbox-local edits do not
+update the S3-backed Session File. Deletion records a tombstone until the worker
+removes the applied copy. The local adapter rejects the feature.
+
+Docker, E2B, CubeSandbox, OpenSandbox, and Daytona expose a writable
 `/mnt/session/outputs` boundary. Docker uses a provider-owned bind mount and
 the Engine archive API; the remote adapters create a unique temporary archive
-and stream it through their official SDK file clients. Before the primary
+and open it through their official SDK file clients. E2B and Cube buffer the
+archive before returning the reader. Before the primary
 Session's idle event is committed, Temporal runs a retryable Activity that
 attaches only to an existing sandbox, streams the output tree, rejects
 non-regular or escaping entries, and publishes each accepted file through the

docs/capabilities.md

@@ -44,15 +44,15 @@ and service test suites.
 | Model and context runtime | Limited | Durable provider-native transcripts, Catwalk-derived model-window profiles with a conservative fallback, provider-usage anchors plus post-anchor estimates, predictive request admission, extractive and oversized-tool-result compaction, one-shot working-turn overflow recovery, and immutable per-Thread turn-preparation checkpoints are implemented. Explicit custom-endpoint overrides, provider-exact counters, complete per-provider-request audit records, later-round projection checkpoints, equivalent Outcome/Advisor overflow recovery, and compaction quality and retention evidence remain open. |
 | Sandbox tools | Limited | `bash`, `read`, `write`, `edit`, `glob`, and `grep`, plus provider-native Web Search/Fetch. Local is development-only; Docker is the current mount-capable isolated backend. |
 | MCP tools | Limited | Streamable HTTP discovery/execution, permissions, journaled calls, large-result materialization, and Vault bearer/OAuth authentication. Private-network connectivity, deprecated SSE, MCP resources, and prompts are not supported. |
-| [Files](api/files.md) | Limited | Configured S3-compatible storage, crash-recoverable intents, reusable snapshotted UTF-8 outcome rubrics, bounded UTF-8 File documents snapshotted into `user.message`, downloadable Session Resource copies, and Docker/OpenSandbox/Daytona publication of regular files beneath `/mnt/session/outputs` before idle. Client uploads are intentionally not downloadable. File-sourced images/PDFs, E2B/Cube output publication, and distributed reconciliation remain open. |
-| [Session Resources](api/session-resources.md) | Limited | Independent File copies and create-time Memory attachments. Runtime File attach/detach works. Docker presents File Resources read-only; OpenSandbox and Daytona currently expose writable sandbox-local copies without changing the S3 source. E2B/Cube File execution, non-Docker Memory mounts, and repository resources are not supported. |
+| [Files](api/files.md) | Limited | Configured S3-compatible storage, crash-recoverable intents, reusable snapshotted UTF-8 outcome rubrics, bounded UTF-8 File documents snapshotted into `user.message`, downloadable Session Resource copies, and Docker/E2B/Cube/OpenSandbox/Daytona publication of regular files beneath `/mnt/session/outputs` before idle. Client uploads are intentionally not downloadable. E2B/Cube currently buffer each output archive in worker memory. File-sourced images/PDFs and distributed reconciliation remain open. |
+| [Session Resources](api/session-resources.md) | Limited | Independent File copies and create-time Memory attachments. Runtime File attach/detach works. Docker presents File Resources read-only; remote adapters expose writable sandbox-local copies without changing the S3 source. E2B/Cube currently buffer each materialized File in worker memory. Non-Docker Memory mounts and repository resources are not supported. |
 | [Skills](api/skills.md) | Limited | Custom Skill lifecycle, immutable Version pins, strict bundle validation, Docker materialization, and on-demand instruction injection. External catalogs, repository sources, self-hosted activation, and remote-sandbox activation remain open. |
 | [Memory](api/memory.md) | Limited | Store/Memory/Version lifecycle, immutable history, SHA-256 preconditions, Docker read/write mounts, and deletion-time writeback. Non-Docker mounts and automatic retention are not implemented. |
 | [Vaults](api/vaults.md) | Limited | Encrypted Vault/Credential lifecycle, ordered Session attachment, OAuth validation, expiry refresh, and token rotation. Environment-variable egress and refresh-failure notifications are not implemented. |
 | [Deployments](api/deployments.md) | Limited | Deployment/Run lifecycle, pinned Agent Versions, Session budget templates, manual runs, cron scheduling, leases, and atomic success/failure records. Repository resources and Agent-archive propagation remain open. |
 | [Environment Work](api/environment-work.md) | Limited | Self-hosted worker leases, polling, heartbeats, state transitions, reclaim, and Session activation. Environment-key issuance, tenant-scoped authorization, Work secrets, and health-check Work remain open. |
 | [Multi-agent](guides/multi-agent.md) | Limited | Persistent ordinary child Agents plus primary-only Mango-managed Advisor consultations over client tool calls, independent transcripts/events/usage, shared Session budgets, reports, routing, interrupts, retries, archive, deletion, and durable context-compaction checkpoints. Broader live-provider evidence and targeted interruption timing remain open. |
-| [Sandbox adapters](sandboxes.md) | Limited / Preview | Local and Docker are available. E2B, CubeSandbox, OpenSandbox, and Daytona have durable bindings; OpenSandbox and Daytona materialize File Resources and stream Session Outputs through their official SDKs, with a documented writable-copy limitation for inputs. Remote adapters remain Preview pending repeated live conformance and production routing policy. |
+| [Sandbox adapters](sandboxes.md) | Limited / Preview | Local and Docker are available. E2B, CubeSandbox, OpenSandbox, and Daytona have durable bindings, materialize File Resources, and publish Session Outputs through their official SDKs. Remote inputs have a documented writable-copy limitation; E2B/Cube additionally buffer file transfers. Remote adapters remain Preview pending repeated live conformance and production routing policy. |
 | Distributed operation | Limited | API and worker roles scale independently around PostgreSQL, Temporal, and NATS. Worker Versioning, heterogeneous-provider routing, distributed Files reconciliation, and production rollout evidence remain open. |
 
 ## Product and operational boundaries

docs/deployment.md

@@ -79,12 +79,14 @@ concurrent upload, Session Resource copy, or Session output publication. These
 are explicit limits until distributed intent leasing and direct multipart
 object-store operations are implemented.
 
-File-backed Session Resources require `MANGO_SANDBOX=docker`, `opensandbox`, or
-`daytona`; the remote providers currently expose writable sandbox-local copies.
-Automatic Session output publication requires `MANGO_SANDBOX=docker`,
-`opensandbox`, or `daytona`. OpenSandbox and Daytona images must provide
-`/bin/sh` and `tar`; output archives stream through the provider SDK and are
-removed after each snapshot. A Docker worker must run where the selected Docker
+File-backed Session Resources require `MANGO_SANDBOX=docker`, `e2b`, `cube`,
+`opensandbox`, or `daytona`; the remote providers currently expose writable
+sandbox-local copies. Automatic Session output publication supports the same
+providers. Every remote image must provide `/bin/sh` and `tar`; output archives
+are removed after each snapshot. OpenSandbox and Daytona stream file transfers,
+while E2B and Cube buffer each File Resource and output archive in worker
+memory, so operators must provision memory for the largest accepted transfer.
+A Docker worker must run where the selected Docker
 Engine API is reachable; the provider uses the Moby Go client directly and does
 not require a `docker` CLI binary. Configure a non-default daemon with
 `DOCKER_HOST` and the standard Docker TLS environment variables. The daemon
@@ -93,7 +95,7 @@ must be able to bind the worker's provider-owned staging directory. Set
 host volume; the default is `mango-resources` beneath the process
 user's home directory. The API and every worker
 on the task queue must agree on the sandbox provider and object-store
-configuration. The local-process, E2B, and Cube adapters reject File Resources.
+configuration. The local-process adapter rejects File Resources.
 
 Memory API contents and immutable Versions live entirely in PostgreSQL and do
 not require S3-compatible storage. Memory-backed Session Resources do require