[anycodes]

Description

Python MCP previously deleted every cached connection at session shutdown, including a sandbox explicitly borrowed from another session with the same credential. Keep creation ownership separate, preserve provider-qualified task handles, and reject explicit CPU/memory requirements that actual platform metadata does not satisfy.

Fixes #139. Fixes #140. Refs Alibaba-Agent-Sandbox/agent-sandbox#46 (remains open).

Changes

• Canonical provider-qualified ownership/cache/TTL/retention; borrowed handles close, owned resources clean up, explicit authorized kill remains available.
• Reject late create/connect completion after shutdown; dispose only the exact corresponding resource/connection.
• Reconnectable task results carry the actual opaque provider:id; clients must return it unchanged. Historical bare IDs retain only the documented unique-cache/default-provider scope.
• Independently verify explicit resource requirements; bind rollback and independent readback to the captured creation context, never a default-region ID lookup.
• Add opt-in real OSS/state/tool/desktop acceptance, pinned optional desktop dependencies and actual screenshot replay. Correct a sticky /tmp test fixture without weakening permissions or runtime behavior.

Testing

• Final283 affected unit tests,13 resource regressions,5 maintained real-cloud lifecycle/resource/task tests pass. Repository health106PASS/0FAIL, lint/typecheck/format/hygiene pass. Detailed results are linked in .agents/evidence/verify/2026-10-26-skill-storage-state-acceptance.md and desktop evidence.
• Real HTTPS source-wheel acceptance: private-port403, bearer401, separate sessions, borrower delete preserves owner, owned session cleanup and retained-task reconnect with before/after stdout;4 independent404 cleanups. Exact v3 wheel scope is recorded; later source changes affect explicit-resource validation and have their own actual-cloud tests.
• Actual OSS read/write/read-only/recreate persistence, pause/restored memory/service/files/mount, platform snapshot clone isolation, deterministic LangGraph reuse/user namespace separation, repository/expiring preview and upgraded third-party filesystem MCP.
• Full local suites retain4 environment-dependent failures after correcting the missing-pip fixture: two raw server HTTP501/502 and two local engine/cube HTTP501 项目网络审计已关闭/502. These are not relabeled passes. Remote final-head Python3.10/3.11/3.12 CI remains required before ready/merge.

Documentation and records

• EN/ZH MCP ownership/resource/opaque-handle compatibility, installation boundaries and optional desktop instructions.
• Unreleased changelog, source Skills/references, proposed feature/process notes and sanitized receipts.
• Actual billing rows, credentials, stream URLs/passwords and user content excluded; screenshots use a synthetic local page. Test-owned resources independently verified absent.

Limits

Private test wheels keep0.4.0a6 metadata to match the source checkout; they are not the public0.4.0a6 bits or a new release. No npm/PyPI publication is performed. Desktop uses official optional e2b-desktop compatibility SDK, simulated operator and screenshot timeline, not new methods in the project client or human-login/video certification. Hosted MCP is an owned temporary acceptance service, not a permanent managed production endpoint. No external-VM import or all-provider certification.

Related CLI PR: Alibaba-Agent-Sandbox/agent-sandbox#188. Website separation delivered by https://github.com/Alibaba-Agent-Sandbox/website/pull/65.

Type of Change

• Bug fix
• Tests
• Documentation

Checklist

• Regression tests and real-component owner evidence included.
• English/Chinese docs, changelog and engineering notes included.
• Lint, formatting, typecheck, repository health and hygiene pass.
• Scoped test-created resources independently cleaned; secrets/private account data excluded.
• Final-head complete remote CI matrix passed. Local environment failures remain documented.

Definition of Done

• Regression tests passing; full local environment failures separately disclosed above.
• E2E executed against real components and recorded in owner evidence; focused actual5-test lifecycle/resource/task suite and other opt-in live runners used.
• Proposed ADR/process records with matching Status; EN/ZH documentation and Unreleased changelog.
• bash scripts/check-repo-health.sh passes.
• No version bump; source client/server remain lockstep0.4.0a6, not a new package release.
• Final-head full remote Python3.10/3.11/3.12 matrix, runtime fixtures, contract checks, cross-language engine and built package checks passed.

Final head d40bd2a: complete CI40269804087 and Docs links40269804106 passed. Remote complete suites establish the normal-environment gate; the four local environmental failures remain retained as failures.