Merge remote-tracking branch 'origin/main' into base-image

Author: ghostwriternr

.github/templates/pr-preview-comment.md

@@ -1,6 +1,6 @@
 ### 🐳 Docker Images Published
 
-**Default (no Python):**
+**Default:**
 
 ```dockerfile
 FROM {{DEFAULT_TAG}}
@@ -12,9 +12,15 @@ FROM {{DEFAULT_TAG}}
 FROM {{PYTHON_TAG}}
 ```
 
+**With OpenCode:**
+
+```dockerfile
+FROM {{OPENCODE_TAG}}
+```
+
 **Version:** `{{VERSION}}`
 
-Use the `-python` variant if you need Python code execution.
+Use the `-python` variant if you need Python code execution, or `-opencode` for the variant with OpenCode AI coding agent pre-installed.
 
 ---
 

.github/workflows/pkg-pr-new.yml

@@ -109,6 +109,22 @@ jobs:
           build-args: |
             SANDBOX_VERSION=${{ steps.package-version.outputs.version }}
 
+      - name: Build and push Docker image (opencode)
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: packages/sandbox/Dockerfile
+          target: opencode
+          platforms: linux/amd64
+          push: true
+          tags: cloudflare/sandbox:${{ steps.package-version.outputs.version }}-opencode
+          cache-from: |
+            type=gha,scope=preview-pr-${{ github.event.pull_request.number }}-opencode
+            type=gha,scope=release-opencode
+          cache-to: type=gha,mode=max,scope=preview-pr-${{ github.event.pull_request.number }}-opencode
+          build-args: |
+            SANDBOX_VERSION=${{ steps.package-version.outputs.version }}
+
       - name: Extract standalone binary from Docker image
         run: |
           VERSION=${{ steps.package-version.outputs.version }}
@@ -136,13 +152,15 @@ jobs:
             const runId = '${{ github.run_id }}';
             const defaultTag = `cloudflare/sandbox:${version}`;
             const pythonTag = `cloudflare/sandbox:${version}-python`;
+            const opencodeTag = `cloudflare/sandbox:${version}-opencode`;
 
             const template = fs.readFileSync('.github/templates/pr-preview-comment.md', 'utf8');
             const body = template
               .replace(/\{\{VERSION\}\}/g, version)
               .replace(/\{\{RUN_ID\}\}/g, runId)
               .replace(/\{\{DEFAULT_TAG\}\}/g, defaultTag)
-              .replace(/\{\{PYTHON_TAG\}\}/g, pythonTag);
+              .replace(/\{\{PYTHON_TAG\}\}/g, pythonTag)
+              .replace(/\{\{OPENCODE_TAG\}\}/g, opencodeTag);
 
             // Find existing comment
             const { data: comments } = await github.rest.issues.listComments({

.github/workflows/pullrequest.yml

@@ -116,15 +116,18 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
-      - name: Build test worker Docker images (base + python)
+      - name: Build test worker Docker images (base + python + opencode)
         run: |
           VERSION=${{ needs.unit-tests.outputs.version || '0.0.0' }}
-          # Build base image (no Python) - used by SandboxBase binding
+          # Build base image (no Python) - used by Sandbox binding
           docker build -f packages/sandbox/Dockerfile --target default --platform linux/amd64 \
             --build-arg SANDBOX_VERSION=$VERSION -t cloudflare/sandbox-test:$VERSION .
-          # Build python image - used by Sandbox binding
+          # Build python image - used by SandboxPython binding
           docker build -f packages/sandbox/Dockerfile --target python --platform linux/amd64 \
             --build-arg SANDBOX_VERSION=$VERSION -t cloudflare/sandbox-test:$VERSION-python .
+          # Build opencode image - used by SandboxOpencode binding
+          docker build -f packages/sandbox/Dockerfile --target opencode --platform linux/amd64 \
+            --build-arg SANDBOX_VERSION=$VERSION -t cloudflare/sandbox-test:$VERSION-opencode .
 
       # Deploy test worker using official Cloudflare action
       - name: Deploy test worker

.github/workflows/release.yml

@@ -108,7 +108,7 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
-      - name: Build test worker Docker images (base + python)
+      - name: Build test worker Docker images (base + python + opencode)
         run: |
           VERSION=${{ needs.unit-tests.outputs.version }}
           # Build base image (no Python) - used by Sandbox binding
@@ -117,6 +117,9 @@ jobs:
           # Build python image - used by SandboxPython binding
           docker build -f packages/sandbox/Dockerfile --target python --platform linux/amd64 \
             --build-arg SANDBOX_VERSION=$VERSION -t cloudflare/sandbox-test:$VERSION-python .
+          # Build opencode image - used by SandboxOpencode binding
+          docker build -f packages/sandbox/Dockerfile --target opencode --platform linux/amd64 \
+            --build-arg SANDBOX_VERSION=$VERSION -t cloudflare/sandbox-test:$VERSION-opencode .
 
       - name: Deploy test worker
         uses: cloudflare/wrangler-action@v3
@@ -213,6 +216,20 @@ jobs:
           build-args: |
             SANDBOX_VERSION=${{ needs.unit-tests.outputs.version }}
 
+      - name: Build and push Docker image (opencode)
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: packages/sandbox/Dockerfile
+          target: opencode
+          platforms: linux/amd64
+          push: true
+          tags: cloudflare/sandbox:${{ needs.unit-tests.outputs.version }}-opencode
+          cache-from: type=gha,scope=release-opencode
+          cache-to: type=gha,mode=max,scope=release-opencode
+          build-args: |
+            SANDBOX_VERSION=${{ needs.unit-tests.outputs.version }}
+
       - name: Extract standalone binary from Docker image
         run: |
           VERSION=${{ needs.unit-tests.outputs.version }}

CLAUDE.md

@@ -291,6 +291,10 @@ Turbo handles task orchestration (`turbo.json`) with dependency-aware builds.
 
 **Subject line should stand alone** - don't require reading the body to understand the change. Body is optional and only needed for non-obvious context.
 
+**Focus on the change, not how it was discovered** - never reference "review feedback", "PR comments", or "code review" in commit messages. Describe what the change does and why, not that someone asked for it.
+
+**Avoid bullet points** - write prose, not lists. If you need bullets to explain a change, you're either committing too much at once or over-explaining implementation details. The body should be a brief paragraph, not a changelog.
+
 Good examples:
 
 ```

examples/claude-code/Dockerfile

@@ -1,4 +1,4 @@
-FROM docker.io/cloudflare/sandbox:0.6.3
+FROM docker.io/cloudflare/sandbox:0.6.4
 RUN npm install -g @anthropic-ai/claude-code
 ENV COMMAND_TIMEOUT_MS=300000
 EXPOSE 3000

examples/code-interpreter/Dockerfile

@@ -1 +1 @@
-FROM docker.io/cloudflare/sandbox:0.6.3-python
+FROM docker.io/cloudflare/sandbox:0.6.4-python

examples/minimal/Dockerfile

@@ -1,4 +1,4 @@
-FROM docker.io/cloudflare/sandbox:0.6.3
+FROM docker.io/cloudflare/sandbox:0.6.4
 
 # Required during local development to access exposed ports
 EXPOSE 8080

examples/openai-agents/Dockerfile

@@ -1,4 +1,4 @@
-FROM docker.io/cloudflare/sandbox:0.6.3
+FROM docker.io/cloudflare/sandbox:0.6.4
 
 # Required during local development to access exposed ports
 EXPOSE 8080

examples/opencode/.dev.vars.example

@@ -0,0 +1 @@
+ANTHROPIC_API_KEY=<YOUR-KEY-HERE>