[anycodes]

Description

ProviderSandbox now reaches Express pause/resume through its own documented lifecycle protocol and rebinds returned session credentials, so an already used object remains usable after resume. Private application traffic credentials are retained separately from envd and application credentials. Explicit command argument objects preserve normal business fields such as timeout, name and arguments.

Refs #152. Companion CLI work: Alibaba-Agent-Sandbox/agent-sandbox#230 . Node consumer: Alibaba-Agent-Sandbox/nodejs-sdk#23 .

Type of Change

• Bug fix
• New feature
• Documentation
• Tests

Changes

• Use Express-specific typed lifecycle behavior in normal and fallback protocol construction; resume rebinds local session state while attach stays read-only.
• Support explicit create network settings and private public-port traffic tokens, excluded from ordinary dumps/representations and default session storage.
• Add commands.invoke(name, arguments, request_timeout=...) and ProviderSandbox.invoke(..., application_token=...) without changing legacy run keyword semantics.
• Add the canonical STS security_token configuration and propagate it through provider/engine credentials.
• Prevent reflected network-rule credentials from surviving in error messages or exception chains while preserving typed/status diagnostics.

Testing

• Complete non-integration client suite: 2390 passed, 26 skipped, 10 deselected.
• Lint, format and mypy; package build/content checks and repository health pass.
• Actual local SandboxServer registered functions, including explicit authenticated ProviderSandbox convenience invocation, pass.
• Real cloud private create, commands/files, same-object pause/resume and subsequent execution, direct/private application invocation, read-only attach, anonymous403 and independent GET404 cleanup executed against the candidate standalone CLI.
• Full local make ci: one unchanged malformed-WebSocket server test receives external HTTP501 instead of the product HTTP400 JSON. The same failure reproduces against untouched server source; no assertion was changed. The client suite ran separately in full.

Checklist

• Client/server package versions remain in lockstep; no version bump or publication
• Regression tests and both language guides/references updated
• No credentials or private raw logs included

Definition of Done

• Latest-head complete required remote matrix passes: CI, Docs.
• Real component results recorded under .agents/evidence/verify/2026-11-05-express-sdk-completion.md
• Proposed ADR and independent adversarial design/implementation review
• English/Chinese documentation, CHANGELOG and repository health

Intermittent runtime network E8020 results are retained alongside independent successful replacement/clearing and HTTP204 controls. Actual storage mounts need user-supplied storage fixtures and belong to the companion CLI acceptance; they are not claimed by these SDK lifecycle/application checks. Existing API Keys are reused; no Key is created or renewed.

Independent final review of this exact head found no additional SDK defect. A fresh 36-check run, including actual local HTTP invocation, passed. The pre-existing local malformed-WebSocket HTTP501 still reproduced with proxy variables removed; its assertion and the complete successful remote matrix were preserved. The SDK shared contract can land independently of the companion CLI storage fixture acceptance.

Post-merge CI run 42007870638 completed successfully on attempt2. Attempt1 is retained: one unchanged MCP child-PID marker test read an empty file before its write completed, while the other language jobs passed. Two independent reviewers confirmed the existence-before-content race and unchanged provenance; only failed jobs were rerun once, with no assertion or product changes. Node consumer post-merge CI also passed.