v2.8.0

This release changes what install.sh and sandy --upgrade install (the latest release, not main), makes codex resume its last session and gives it a one-command login, adds sandy --accounts, and makes an agent that cannot run fail the image build instead of shipping. schema_version stays 4: every introspection change is additive. SANDY_SANDBOX_MIN_COMPAT stays 2.0.0, so existing sandboxes keep working.

One-time rebuild. Agent images rebuild on first launch, because the generated Dockerfiles and user-setup.sh changed.

Upgrade notes

• install.sh and sandy --upgrade install the latest release (#440). Both used to download main, so a new user got unreleased code and --upgrade moved a stable user onto the dev line. To follow main, set SANDY_CHANNEL=dev on the install or the upgrade; a dev build records its commit. A plain --upgrade never downgrades a dev or rc build that is newer than the latest release; SANDY_CHANNEL=release sandy --upgrade does that on purpose. If the release cannot be looked up, both stop with an error rather than installing main. The "Update available" notice also works again: its GitHub lookup never matched the API's formatting, so it never fired.
• Sandy no longer pins a codex model (#447). Codex now starts on its own default. An existing sandbox whose config.toml still carries sandy's old seeded pin (an exact top-level model = "gpt-5.4" or "gpt-5.5" in a file sandy wrote) loses that one line at its next launch, with one info line. A model you chose, a [profiles.*] model, or a file sandy did not seed is left alone. CODEX_MODEL still selects a model per launch.

New

• Codex resumes its last session (#427). An interactive codex launch runs codex resume --last when the sandbox holds an interactive session for this workspace, as claude's --continue does. sandy --new starts fresh and sandy --resume opens codex's picker. Headless runs are never resumed.
• sandy --login codex (#428) logs codex into this sandbox with codex login --device-auth, the flow that works in a container (plain codex login waits on a localhost callback a host browser cannot reach). It uses the workspace's running container when there is one, otherwise a one-shot launch. The login persists in the sandbox.
• sandy --accounts [--json] [--workspace P] (#438) reports, per sandbox, the Anthropic account Claude Code last recorded there (email, organization, plan), the credential mode of the last launch, and whether a session is running. Filesystem only; no Docker.
• Protected submounts in feature manifests (#444). A feature can place a read-only child inside one of its writable mounts ("submounts": [{"parent": "work", "path": "results", "from": "…"}]), for results written by something outside the container or a trusted config file. Sources that are writable through another mount, overlapping children and symlinks anywhere on the path are refused. Gate on submounts in --print-schema's manifest.top_level_keys.
• base_type on every config key in --print-schema (string, bool or int, derived from type), so a client meeting a type it does not know can still render a working input (#440).

Fixed

• An agent that installs but cannot run now fails the image build (#448). On 2026-10-07 npm served @openai/codex@0.161.0 before its platform binary, and images built in that window shipped a codex that could not start ("Missing optional dependency"). Every agent install step now fails the build if the agent cannot report its version; an update rebuild that hits such a window keeps the existing image and retries at the next launch. An image already broken this way is rebuilt at its next launch. The codex update check now reads npm, which the build installs from, instead of GitHub releases, which announce a version minutes earlier.
• SANDY_CODEX_AUTH=oauth withholds OPENAI_API_KEY from the container (#429), so one codex credential is in the box (opencode beside it still receives the key it needs).
• SANDY_CLAUDE_AUTH=oauth withholds a long-lived CLAUDE_CODE_OAUTH_TOKEN when an account login exists, falling back to the token with a warning when none does (#437). claude.ai connectors load only for an account login, so SANDY_CLAUDE_CONNECTORS=1 plus oauth is how one workspace gets connectors while the rest keep a global token. A launch with connectors on and a credential that cannot load them now warns.

Docs

• The README is now a short front page; the detail moved to docs/guide/ (#443). It gained a "Why sandy" section with a comparison against Docker Sandboxes, OpenShell and the agents' built-in sandboxes (#442).
• sandy, explained is a guided walkthrough on GitHub Pages (#435).
• SPEC_INTROSPECTION lists the known consumers of sandy's output, and any future schema_version change ships in a release candidate first, with an issue opened in each consumer's repo (#440).

Known issues

• The scheduled Linux Integration workflow is red in §23 (the handoff-directories acceptance harness) on GitHub runners (#426).
• test/run-tests.sh §123 can leave feature-entry supervisor loops running after the suite ends (#431). This affects the test suite only.

Testing

• CI (Linux): the Tests and proxy workflows pass on the release commit.
• Each change was checked with the full run-tests.sh against main (no new failures) and its new checks were mutation-tested.