From 10a8cf2f9cd00f58fe25069fa00ebfdcdbc778b7 Mon Sep 17 00:00:00 2001 From: paulieb89 Date: Thu, 16 Jul 2026 17:00:56 +0100 Subject: [PATCH] Bound sandbox resources and lifetime to cut provisioned-memory cost eve defaults the Vercel sandbox to a 30-minute wall-clock timeout and no resource cap. The timeout is not idle-based (confirmed against the Vercel Sandbox SDK docs): a VM bills provisioned memory for the full window regardless of activity, so a 2-minute task still holds its sandbox for ~30 minutes. evolve was the 2nd-heaviest project on Sandbox Provisioned Memory (95.6 GB-Hrs/cycle). Pin vcpus: 1 (2048 MB) and timeout: 15 min, guarded to hosted Vercel only so local `eve dev` keeps the default docker/bash backend. Both are env-tunable (EVOLVE_SANDBOX_VCPUS / EVOLVE_SANDBOX_TIMEOUT_MS). Sessions survive a stopped VM via persistent + resume; the only exposure is a single sandbox command longer than the timeout, and evolve's commands run well under a minute (15 min also leaves headroom for start_background). Co-Authored-By: Claude Opus 4.8 --- agent/sandbox.ts | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/agent/sandbox.ts b/agent/sandbox.ts index 01c476f..e784ac9 100644 --- a/agent/sandbox.ts +++ b/agent/sandbox.ts @@ -1,6 +1,30 @@ import { defineSandbox } from "eve/sandbox"; +import { vercel } from "eve/sandbox/vercel"; + +// eve defaults the Vercel sandbox to a 30-minute wall-clock timeout and no +// resource cap. The timeout is not idle-based: a sandbox bills provisioned +// memory for the whole window regardless of activity, so a 2-minute task still +// holds its VM for ~30 minutes. Bound both to cut cost. Sessions survive a +// stopped VM (persistent + resume), so the only exposure is a single sandbox +// command longer than the timeout — evolve's commands are well under a minute, +// leaving a wide margin (15 min also keeps headroom for start_background jobs). +// Both are env-tunable so limits can change without a code edit + redeploy. +const SANDBOX_TIMEOUT_MS = + Number(process.env.EVOLVE_SANDBOX_TIMEOUT_MS) || 15 * 60 * 1000; +const SANDBOX_VCPUS = Number(process.env.EVOLVE_SANDBOX_VCPUS) || 1; export default defineSandbox({ + // Pin the Vercel backend (with the caps) only on hosted Vercel. Locally, omit + // it so eve's default backend (docker/bash) runs — otherwise `eve dev` would + // try to create real hosted sandboxes. + ...(process.env.VERCEL + ? { + backend: vercel({ + timeout: SANDBOX_TIMEOUT_MS, + resources: { vcpus: SANDBOX_VCPUS }, + }), + } + : {}), revalidationKey: () => "safe-directory-v1", // eve's channel-managed GitHub checkout runs git in /workspace, whose // directory ownership differs from the sandbox user, so git aborts every