Use sandbox client for builder validation

agent_builder/tools.py

@@ -31,7 +31,7 @@ if TYPE_CHECKING:
     from .config import Settings
 
 
-A2A_PACK_MIN_VERSION = "0.1.60"
+A2A_PACK_MIN_VERSION = "0.1.75"
 
 
 @dataclass(frozen=True)
@@ -40,6 +40,7 @@ class ToolContext:
     settings: "Settings"
     cp_jwt: str | None = None
     workspace: Any | None = None
+    sandbox: Any | None = None
     grant_token: str | None = None
 
 
@@ -444,6 +445,29 @@ def build_tools(ctx: ToolContext) -> list[Any]:
             "  a2a frontend info --project . || true\n"
             "fi\n"
         )
+        if ctx.sandbox is not None:
+            try:
+                out = await ctx.sandbox.run_shell(
+                    script,
+                    image=settings.image,
+                    workspace=bucket,
+                    memory_mib=512,
+                    timeout_seconds=settings.sandbox_timeout_s,
+                )
+            except Exception as exc:  # noqa: BLE001
+                return json.dumps({
+                    "error": f"sandbox {type(exc).__name__}",
+                    "detail": str(exc)[:1000],
+                })
+            result: dict[str, Any] = {
+                "exit_code": getattr(out, "exit_code", None),
+                "stdout": (getattr(out, "stdout", "") or "")[:4000],
+                "stderr": (getattr(out, "stderr", "") or "")[:4000],
+            }
+            if sanitized_fields:
+                result["sanitized_agent_card_fields"] = list(sanitized_fields)
+            return json.dumps(result)
+
         headers = _sandbox_headers(settings.sandbox_token, ctx.grant_token)
         async with httpx.AsyncClient(timeout=settings.sandbox_timeout_s + 30) as c:
             r = await c.post(