diff --git a/deploy/cwsandbox/README.md b/deploy/cwsandbox/README.md
new file mode 100644
index 0000000000..67b705e495
--- /dev/null
+++ b/deploy/cwsandbox/README.md
@@ -0,0 +1,297 @@
+# CoreWeave Sandbox provider
+
+[CoreWeave Sandbox](https://docs.coreweave.com/products/sandboxes) gives you
+disposable cloud machines for running Omnigent hosts, two ways:
+
+- **CLI-launched**: `omnigent sandbox create` / `connect` provisions a sandbox
+  from your terminal, ships your local checkout into it, and registers it as a
+  host with your server.
+- **Server-managed**: the server provisions a sandbox automatically when a
+  session is created with `"host_type": "managed"` and terminates it when the
+  session is deleted.
+
+The launcher wraps the official
+[`cwsandbox`](https://github.com/coreweave/cwsandbox-client) Python SDK, gated
+behind the `cwsandbox` extra and imported lazily — same posture as the Modal and
+Daytona launchers. Sandboxes boot from the official prebaked host image, so
+startup is seconds.
+
+Two traits shape the rest of this guide:
+
+- **No local port forward.** CoreWeave Sandbox can't forward a sandbox→laptop
+  callback port, so the interactive in-sandbox `omnigent login` / App OAuth step
+  is skipped automatically (as on Modal and Daytona) — fine for token/OIDC-auth
+  servers.
+- **No egress by default.** CW Sandbox blocks outbound traffic unless asked; the
+  launcher requests `egress_mode: internet` so the host can reach your server and
+  the agent can reach its model endpoint.
+
+```bash
+pip install 'omnigent[cwsandbox]'
+```
+
+## Prerequisites
+
+Create a CoreWeave Sandbox API key and make it available where the launcher
+runs — your shell for the CLI flow, the **server** process for managed sandboxes
+(12-factor; never in config files):
+
+```bash
+export CWSANDBOX_API_KEY=...                          # CoreWeave Sandbox API key
+export CWSANDBOX_BASE_URL=https://api.cwsandbox.com   # optional (this is the default)
+```
+
+## The host image
+
+Sandboxes boot from `ghcr.io/omnigent-ai/omnigent-host:latest`, published by CI
+from the `host` target of [`deploy/docker/Dockerfile`](../docker/Dockerfile)
+with Omnigent and its dependencies preinstalled — including the coding-harness
+CLIs (`claude`, `codex`, `pi`), so agents on any harness run without an
+in-sandbox install.
+
+To use a different image (a fork, or extra tooling baked in), build the same
+target and push it anywhere CoreWeave can pull from:
+
+```bash
+docker build -f deploy/docker/Dockerfile --target host \
+  --platform linux/amd64 \
+  -t docker.io/<you>/omnigent-host:latest .
+docker push docker.io/<you>/omnigent-host:latest
+```
+
+Then point Omnigent at it — `OMNIGENT_CWSANDBOX_HOST_IMAGE` for the CLI flow, or
+`sandbox.cwsandbox.image` in the server config for the managed flow.
+
+> [!NOTE]
+> Building on Apple Silicon? Pass `--platform linux/amd64` — sandboxes run
+> x86_64.
+
+## CLI-launched sandboxes
+
+Provision a sandbox and ship your local checkout into it:
+
+```bash
+omnigent sandbox create --provider cwsandbox --server https://your-host
+```
+
+This pulls the host image, builds wheels from your local checkout, and overlays
+them on top — so the sandbox runs *your* code, not whatever the image was built
+from. Then register it as a host with your server:
+
+```bash
+omnigent sandbox connect --provider cwsandbox \
+  --sandbox-id <id-printed-by-create> \
+  --server https://your-host
+```
+
+`connect` runs `omnigent host` inside the sandbox and holds the connection open
+in your terminal — Ctrl-C tears it down. New sessions targeting that host now run
+in the sandbox.
+
+Running multiple sandboxes against one server? Pass a unique `--host-name
+<label>` to each `connect` — the server keys hosts on (owner, name), and
+sandboxes that share a hostname collide.
+
+Sandboxes are disposable. When your code changes, create a new one.
+
+To inject LLM/git credentials into a CLI-launched sandbox, set
+`OMNIGENT_CWSANDBOX_SANDBOX_ENV` in your shell to a comma-separated list of
+variable names (e.g. `ANTHROPIC_API_KEY,GIT_TOKEN`) before running `create` — the
+named variables are copied from your environment into the sandbox at provision
+time. A listed name that is **not** set fails the launch loudly (it would
+otherwise surface much later as an opaque harness auth failure inside the
+sandbox).
+
+### Connecting to an authenticated server
+
+`connect` runs `omnigent host` inside the sandbox, and that host must present
+credentials when it dials back to a server that requires authentication. The
+interactive `omnigent login` browser flow can't run inside a sandbox (no callback
+port forward), so inject the keys for the relevant server instead — name them in
+`OMNIGENT_CWSANDBOX_SANDBOX_ENV` before `create`:
+
+```bash
+export OMNIGENT_CWSANDBOX_SANDBOX_ENV=DATABRICKS_HOST,DATABRICKS_TOKEN
+omnigent sandbox create --provider cwsandbox --server https://your-host
+```
+
+The in-sandbox host mints a fresh bearer token from those credentials on every
+connect and reconnect. For a Databricks-fronted server, inject `DATABRICKS_HOST`
+plus either `DATABRICKS_TOKEN` (a PAT) or `DATABRICKS_CLIENT_ID` /
+`DATABRICKS_CLIENT_SECRET` (an OAuth service principal — re-minting keeps a
+long-lived sandbox connected past any single token's expiry).
+
+A server with no authentication on the host tunnel needs none of this, and
+neither do [server-managed sandboxes](#server-managed-sandboxes) — those
+authenticate with a server-minted per-launch token automatically.
+
+## Server-managed sandboxes
+
+Add a `sandbox:` section to the server config (`omnigent server -c config.yaml`,
+or `<data_dir>/config.yaml`):
+
+```yaml
+sandbox:
+  provider: cwsandbox
+  server_url: https://your-host    # public URL sandboxes dial back to
+```
+
+`provider` + `server_url` is a complete config. `server_url` **must be reachable
+from CoreWeave** — the host inside the sandbox opens an outbound WebSocket to it,
+not `localhost`. For local testing, expose your server with a tunnel
+(`cloudflared` / `ngrok`) and point `server_url` at the tunnel URL. The server
+itself needs `CWSANDBOX_API_KEY` (and optional `CWSANDBOX_BASE_URL`) in its
+environment.
+
+Sessions created with `host_type: "managed"` (the API call or the Web UI's New
+Sandbox option) then run on a fresh CW sandbox; the create returns immediately
+and provisioning happens in the background, exactly like the [Modal managed
+flow](../modal/README.md#server-managed-sandboxes) — including repository
+workspaces, the first-message rendezvous, and dead-sandbox relaunch.
+
+```bash
+curl -X POST https://your-host/v1/sessions \
+  -H "Content-Type: application/json" \
+  -d '{"agent_id": "agent_...", "host_type": "managed"}'
+```
+
+Each managed sandbox authenticates back with a server-minted, per-launch token;
+no user credentials enter the sandbox for the server connection.
+
+Optional `cwsandbox:` settings:
+
+```yaml
+sandbox:
+  provider: cwsandbox
+  server_url: https://your-host
+  cwsandbox:
+    image: docker.io/<you>/omnigent-host:latest        # default: official image
+    env: [OPENAI_API_KEY, ANTHROPIC_API_KEY, GIT_TOKEN]  # server env var NAMES to inject
+```
+
+### Managed hosts and server auth
+
+How the dial-back authenticates depends on how the **server** does auth, and
+there is one interaction worth knowing before you deploy. A managed sandbox opens
+two kinds of connections back to the server: the **host tunnel**, which the
+per-launch token authenticates directly (always works), and one **runner tunnel**
+per session, opened by the runner subprocess — which authenticates with whatever
+server credential it can resolve, **not** the per-launch host token.
+
+The consequence:
+
+- **Header / OIDC-proxy auth, or single-user (no-auth) servers** — the runner
+  tunnel needs no extra identity, so managed hosts work out of the box.
+- **The built-in `accounts` provider (`OMNIGENT_AUTH_ENABLED=1`)** — the runner
+  tunnel additionally requires a *user* identity, which the per-launch host token
+  does not carry, so the runner dial-back is refused (`403`) even though the host
+  tunnel connects. This is a framework-level managed-host interaction shared by
+  **all** sandbox providers (Modal / Daytona / Islo / cwsandbox), not specific to
+  cwsandbox.
+
+So for a managed cwsandbox deployment, front the server with **header or OIDC
+auth** (a reverse proxy / IdP injects the user identity on every request,
+including the runner WebSocket — see
+[`deploy/README.md#auth`](../README.md#auth)), or run it single-user. The
+`accounts` provider is fine for CLI-launched hosts (you `omnigent login`, and
+that token is what the in-sandbox host forwards), but not yet for the managed
+runner dial-back.
+
+## Model credentials (LLM keys)
+
+A fresh sandbox has no model credentials. Name the variables to inject in
+`OMNIGENT_CWSANDBOX_SANDBOX_ENV` (CLI) or `sandbox.cwsandbox.env` (managed); the
+launcher copies the value from the launching environment into the sandbox, and
+the in-sandbox host forwards the standard harness credential vars to its runners:
+
+```bash
+export ANTHROPIC_API_KEY=sk-ant-…   # on the server (managed) or in your shell (CLI)
+```
+
+```yaml
+sandbox:
+  provider: cwsandbox
+  server_url: https://your-host
+  cwsandbox:
+    env: [ANTHROPIC_API_KEY]
+```
+
+Which variables to inject — providers, gateways, subscriptions, git — is
+identical to Modal; see the [variable table and per-plan
+recipes](../modal/README.md#llm-credentials-for-managed-sandboxes) and [git
+credentials](../modal/README.md#git-credentials-private-repositories). For a
+Claude **subscription** specifically, run `claude setup-token` on your own
+machine (one-time browser auth) and inject the resulting long-lived token as
+`CLAUDE_CODE_OAUTH_TOKEN`. For env vars beyond the standard set, inject
+`OMNIGENT_RUNNER_ENV_PASSTHROUGH=NAME1,NAME2`.
+
+## Git credentials (private repositories)
+
+Inject an HTTPS token as `GIT_TOKEN` (GitLab: add `GIT_USERNAME=oauth2`) via
+`OMNIGENT_CWSANDBOX_SANDBOX_ENV` / `sandbox.cwsandbox.env`. The host image's git
+credential helper answers HTTPS auth from it for both the launch-time clone and
+the agent's later `fetch` / `push`, writing nothing to disk. Use HTTPS repository
+URLs. Details by provider match the [Modal git
+guide](../modal/README.md#git-credentials-private-repositories).
+
+## Security considerations
+
+- **Injected credentials live in CoreWeave's control plane.** The launcher passes
+  `sandbox.cwsandbox.env` values to the CoreWeave API as sandbox environment
+  variables, so a third party holds whatever you inject (LLM keys, `GIT_TOKEN`)
+  for the sandbox's life. Prefer **scoped, short-lived** credentials: a
+  fine-grained PAT limited to the repos a session needs, a gateway token over a
+  root provider key.
+- **All managed sandboxes share one CoreWeave org + `CWSANDBOX_API_KEY`.**
+  Cross-user isolation rides on CoreWeave's sandbox boundaries, and the shared key
+  can enumerate and delete any sandbox — the same single-tenant-org shape as the
+  Modal and Daytona providers. Scope the org to this workload and nothing else.
+- **The launch token's lifetime tracks the sandbox lifetime.** CW Sandbox's
+  lifetime is operator-overridable (`OMNIGENT_CWSANDBOX_MAX_LIFETIME_S`, 24h
+  default), so the per-launch host token TTL is derived from it — always above the
+  cap, so a live sandbox can re-authenticate across reconnects while a leaked
+  token can't outlive the sandbox it came from. A relaunch mints a fresh one.
+
+## Notes / limits
+
+- Sandboxes are reaped at `max_lifetime_seconds` (24h default; override with
+  `OMNIGENT_CWSANDBOX_MAX_LIFETIME_S`). The managed launch-token TTL is set above
+  that so reconnects keep working.
+- Egress defaults to none on CW Sandbox; the launcher requests `egress_mode:
+  internet` so the host can reach the server and the agent can reach its model
+  endpoint.
+
+## Troubleshooting
+
+- **"managed host did not come online within 120s"** — the server waits up to two
+  minutes for the in-sandbox host to register. If it times out, check that
+  `server_url` is publicly reachable from CoreWeave, then inspect the in-sandbox
+  host log: `/tmp/omnigent-host.log`.
+- **Slow first launch** — the first launch from a given image waits on a cold
+  registry pull before the sandbox is ready; subsequent launches reuse the cached
+  image and start in seconds.
+- **Agent has no credentials** — verify the injected var names match the
+  forwarded set (or are named in `OMNIGENT_RUNNER_ENV_PASSTHROUGH`), and that each
+  name was actually set in the launching environment.
+
+## Environment variable reference
+
+| Variable | Where it's read | Purpose |
+|---|---|---|
+| `CWSANDBOX_API_KEY` | CLI machine / server | CoreWeave Sandbox API credentials (required) |
+| `CWSANDBOX_BASE_URL` | CLI machine / server | Non-default CW Sandbox API endpoint (default `https://api.cwsandbox.com`) |
+| `OMNIGENT_CWSANDBOX_HOST_IMAGE` | CLI machine / server | Override the host image ref (`sandbox.cwsandbox.image` takes precedence for managed) |
+| `OMNIGENT_CWSANDBOX_SANDBOX_ENV` | CLI machine / server | Comma-separated launcher-side env var names to inject (`sandbox.cwsandbox.env` takes precedence for managed) |
+| `OMNIGENT_CWSANDBOX_MAX_LIFETIME_S` | CLI machine / server | Sandbox lifetime cap in seconds (default 24h); also derives the managed launch-token TTL |
+| `OMNIGENT_RUNNER_ENV_PASSTHROUGH` | inside the sandbox (injected) | Extra env var names the host forwards to runners |
+| `GIT_TOKEN` / `GIT_USERNAME` | inside the sandbox (injected) | HTTPS credentials for private repository clone / fetch / push |
+
+## Smoke test
+
+Validate the API primitives directly (no Omnigent or SDK install needed — stdlib
++ curl only):
+
+```bash
+export CWSANDBOX_API_KEY=...
+python tests/e2e/integrations/deploy/cwsandbox/smoke_test.py
+```
diff --git a/deploy/islo/README.md b/deploy/islo/README.md
index 7991f3833d..bf8d68816d 100644
--- a/deploy/islo/README.md
+++ b/deploy/islo/README.md
@@ -475,14 +475,6 @@ free credits. Rates: [islo.dev](https://islo.dev).
 - **"managed host did not come online within 120s."** Check that
   `server_url` is publicly reachable from Islo's cloud, then inspect the
   in-sandbox host log: `~/.omnigent/logs/host-runner/*.log`.
-- **UI stuck on "Provisioning sandbox…" but a refresh shows the reply.**
-  The host and runner are connected — the browser just isn't receiving live
-  updates. The Web UI streams session state over SSE
-  (`/v1/sessions/{id}/stream`), and some dev tunnels (cloudflared / ngrok
-  quick tunnels) buffer streaming responses. Use an ingress that doesn't
-  buffer SSE, or point your browser directly at the server — `server_url`
-  only needs to be reachable from Islo's cloud for the sandbox dial-back,
-  not from your browser.
 - **Agent has no credentials.** Verify the injected var names match the
   forwarded set above (or are named in `OMNIGENT_RUNNER_ENV_PASSTHROUGH`),
   and that each name was actually set in the launching environment.
diff --git a/omnigent/onboarding/sandboxes/__init__.py b/omnigent/onboarding/sandboxes/__init__.py
index 516635ace8..e000c1b071 100644
--- a/omnigent/onboarding/sandboxes/__init__.py
+++ b/omnigent/onboarding/sandboxes/__init__.py
@@ -58,6 +58,9 @@
     "lakebox": "omnigent.onboarding.sandboxes.lakebox:LakeboxLauncher",
     "modal": "omnigent.onboarding.sandboxes.modal:ModalSandboxLauncher",
     "daytona": "omnigent.onboarding.sandboxes.daytona:DaytonaSandboxLauncher",
+    # CoreWeave Sandbox via the official cwsandbox SDK (the
+    # `omnigent[cwsandbox]` extra), imported lazily like modal/daytona.
+    "cwsandbox": "omnigent.onboarding.sandboxes.cwsandbox:CWSandboxLauncher",
     "islo": "omnigent.onboarding.sandboxes.islo:IsloSandboxLauncher",
 }
 
diff --git a/omnigent/onboarding/sandboxes/cwsandbox.py b/omnigent/onboarding/sandboxes/cwsandbox.py
new file mode 100644
index 0000000000..7566713ffc
--- /dev/null
+++ b/omnigent/onboarding/sandboxes/cwsandbox.py
@@ -0,0 +1,313 @@
+"""
+CoreWeave Sandbox launcher.
+
+Implements :class:`SandboxLauncher` for `CoreWeave Sandbox
+<https://docs.coreweave.com/products/sandboxes>`_ on top of the official
+``cwsandbox`` Python SDK. Same posture as the Modal and Daytona
+launchers: the SDK is an optional dependency (``pip install
+'omnigent[cwsandbox]'``) imported lazily, so the provider can be listed
+and the module probed without it.
+
+Supports both server-managed hosts (``host_type="managed"`` sessions)
+and the CLI bootstrap flow. The one unsupported primitive is
+``forward_local_port``: CW Sandbox has no local→sandbox path, so the
+Databricks App OAuth flow doesn't apply — managed hosts authenticate
+with a server-minted launch token instead.
+
+Notes that shape this launcher:
+
+- Egress defaults to none on CW Sandbox, so :meth:`provision` requests
+  ``egress_mode="internet"`` — a managed host must dial the server out.
+- Lifetime is a single hard cap (``max_lifetime_seconds``); there is no
+  idle auto-stop. The managed token TTL is set above the cap.
+- Credentials and base URL come from the SDK's own env vars
+  (``CWSANDBOX_API_KEY`` / ``CWSANDBOX_BASE_URL``), 12-factor.
+"""
+
+from __future__ import annotations
+
+import os
+from collections.abc import Sequence
+from typing import TYPE_CHECKING, ClassVar
+
+import click
+
+from omnigent.onboarding.sandboxes.base import (
+    DEFAULT_HOST_IMAGE,
+    RemoteCommandResult,
+    RemoteProcess,
+    SandboxLauncher,
+    host_image_wheel_install_command,
+)
+
+if TYPE_CHECKING:
+    from collections.abc import Iterator
+    from pathlib import Path
+
+    from cwsandbox import Sandbox
+    from cwsandbox._types import Process
+
+HOST_IMAGE_ENV_VAR = "OMNIGENT_CWSANDBOX_HOST_IMAGE"
+SANDBOX_ENV_PASSTHROUGH_ENV_VAR = "OMNIGENT_CWSANDBOX_SANDBOX_ENV"
+MAX_LIFETIME_ENV_VAR = "OMNIGENT_CWSANDBOX_MAX_LIFETIME_S"
+
+_DEFAULT_MAX_LIFETIME_S = 24 * 60 * 60
+_SANDBOX_RESOURCES = {"cpu": "2", "memory": "4Gi"}
+# Slack the managed launch-token TTL is set above the sandbox lifetime, so a
+# live sandbox can always re-authenticate its tunnel across reconnects.
+_TOKEN_TTL_SLACK_S = 3600
+# Where exec_foreground records the remote pid so Ctrl-C can kill it — the
+# SDK's process.cancel() only cancels the local future, not the remote exec.
+_FOREGROUND_PIDFILE = "/tmp/oa-foreground.pid"
+
+
+def resolve_max_lifetime_s() -> int:
+    """Resolve the sandbox lifetime cap in seconds (env override or default)."""
+    raw = os.environ.get(MAX_LIFETIME_ENV_VAR)
+    if raw is None:
+        return _DEFAULT_MAX_LIFETIME_S
+    try:
+        return int(float(raw))
+    except ValueError as exc:
+        raise click.ClickException(f"{MAX_LIFETIME_ENV_VAR} must be a number of seconds") from exc
+
+
+def managed_token_ttl_s() -> int:
+    """Launch-token TTL, derived from (and always above) the sandbox lifetime."""
+    return resolve_max_lifetime_s() + _TOKEN_TTL_SLACK_S
+
+
+def _ensure_sdk() -> None:
+    """Verify the cwsandbox SDK is importable, with an install hint when not."""
+    try:
+        import cwsandbox  # noqa: F401
+    except ImportError as exc:
+        raise click.ClickException(
+            "The cwsandbox SDK is required for the 'cwsandbox' sandbox provider. "
+            "Install it with `pip install 'omnigent[cwsandbox]'`, then set "
+            "CWSANDBOX_API_KEY (and optionally CWSANDBOX_BASE_URL)."
+        ) from exc
+
+
+class _CWRemoteProcess(RemoteProcess):
+    """:class:`RemoteProcess` over a cwsandbox ``Process`` (combined output)."""
+
+    def __init__(self, process: Process) -> None:
+        self._process = process
+        self._lines: Iterator[str] = iter(process.stdout)
+
+    @property
+    def lines(self) -> Iterator[str]:
+        return self._lines
+
+    def wait(self) -> int:
+        return self._process.wait()
+
+    def close(self) -> None:
+        # DEVIATION from the base contract: the SDK's process.cancel() only
+        # cancels the local future, not the remote exec, so a still-running
+        # process is left to die with the sandbox. Unreachable in practice —
+        # the only stream_exec consumer is the App OAuth flow, which the
+        # bootstrap gates off for cwsandbox (supports_local_port_forward=False).
+        self._process.cancel()
+
+
+class CWSandboxLauncher(SandboxLauncher):
+    """:class:`SandboxLauncher` for CoreWeave Sandbox, over the ``cwsandbox`` SDK."""
+
+    provider: ClassVar[str] = "cwsandbox"
+    supports_local_port_forward: ClassVar[bool] = False
+
+    def __init__(self, *, image: str | None = None, env: Sequence[str] | None = None) -> None:
+        """
+        :param image: Registry image to provision from
+            (``sandbox.cwsandbox.image``); ``None`` resolves
+            :data:`HOST_IMAGE_ENV_VAR` then the official host image.
+        :param env: Server-process env var NAMES to inject into every
+            sandbox (``sandbox.cwsandbox.env``); ``None`` resolves
+            :data:`SANDBOX_ENV_PASSTHROUGH_ENV_VAR`.
+        """
+        # Import the SDK now, on the constructing thread. The managed flow
+        # builds the launcher on the event-loop (main) thread but calls
+        # prepare()/provision() via asyncio.to_thread; the cwsandbox SDK
+        # installs signal handlers at import time, which raises in a
+        # worker thread ("signal only works in main thread"). Importing
+        # here makes the later worker-thread imports cached no-ops.
+        # Removable once the SDK fix ships (coreweave/cwsandbox-client#136,
+        # PR #138 — skip signal handlers outside the main thread).
+        _ensure_sdk()
+        self._image_ref = image
+        self._env_names = tuple(env) if env is not None else None
+        self._sandboxes: dict[str, Sandbox] = {}
+
+    def _resolve(self, sandbox_id: str) -> Sandbox:
+        """Return the cached handle for *sandbox_id*, attaching on first use."""
+        _ensure_sdk()
+        from cwsandbox import Sandbox
+        from cwsandbox.exceptions import SandboxNotFoundError
+
+        handle = self._sandboxes.get(sandbox_id)
+        if handle is None:
+            try:
+                handle = Sandbox.from_id(sandbox_id).result()
+            except SandboxNotFoundError as exc:
+                raise click.ClickException(
+                    f"CW Sandbox '{sandbox_id}' not found — it may have been stopped "
+                    "or reached its lifetime cap."
+                ) from exc
+            self._sandboxes[sandbox_id] = handle
+        return handle
+
+    def _resolve_sandbox_env(self) -> dict[str, str]:
+        """Resolve env var names to inject, reading values from the server env."""
+        if self._env_names is not None:
+            names: Sequence[str] = self._env_names
+        else:
+            names = [
+                name.strip()
+                for name in os.environ.get(SANDBOX_ENV_PASSTHROUGH_ENV_VAR, "").split(",")
+                if name.strip()
+            ]
+        resolved: dict[str, str] = {}
+        for name in names:
+            value = os.environ.get(name)
+            if value is None:
+                raise click.ClickException(
+                    f"sandbox env passthrough names '{name}' but it is not set in the "
+                    "server's environment — set it or remove it from sandbox.cwsandbox.env "
+                    f"/ {SANDBOX_ENV_PASSTHROUGH_ENV_VAR}."
+                )
+            resolved[name] = value
+        return resolved
+
+    def prepare(self) -> None:
+        """Preflight: the SDK must be installed and an API key available."""
+        _ensure_sdk()
+        if not os.environ.get("CWSANDBOX_API_KEY"):
+            raise click.ClickException(
+                "No CW Sandbox credentials found — set CWSANDBOX_API_KEY to a "
+                "CoreWeave Sandbox API key."
+            )
+
+    def provision(self, name: str) -> str:
+        """Create a sandbox from the host image and wait until it is running."""
+        _ensure_sdk()
+        from cwsandbox import NetworkOptions, Sandbox
+        from cwsandbox.exceptions import CWSandboxError
+
+        image = self._image_ref or os.environ.get(HOST_IMAGE_ENV_VAR) or DEFAULT_HOST_IMAGE
+        max_lifetime = resolve_max_lifetime_s()
+        env_vars = self._resolve_sandbox_env()
+        click.echo(f"▸ Creating CW Sandbox '{name}' from {image}")
+        try:
+            sandbox = Sandbox.run(
+                "sleep",
+                "infinity",
+                container_image=image,
+                max_lifetime_seconds=max_lifetime,
+                resources=dict(_SANDBOX_RESOURCES),
+                # Egress defaults to none; a managed host must dial the server out.
+                network=NetworkOptions(egress_mode="internet"),
+                environment_variables=env_vars or None,
+                tags=["omnigent", name],
+            )
+            sandbox.wait()
+        except CWSandboxError as exc:
+            raise click.ClickException(f"CW Sandbox creation failed: {exc}") from exc
+        sandbox_id = sandbox.sandbox_id
+        if not sandbox_id:
+            raise click.ClickException("CW Sandbox creation returned no sandbox id")
+        self._sandboxes[sandbox_id] = sandbox
+        click.echo(f"  → created {sandbox_id}")
+        return sandbox_id
+
+    def attach(self, sandbox_id: str) -> None:
+        """Validate access to an existing sandbox by id."""
+        click.echo(f"▸ Reusing existing CW Sandbox '{sandbox_id}'")
+        self._resolve(sandbox_id)
+
+    def keep_alive(self, sandbox_id: str) -> None:
+        """Nothing to configure: lifetime is fixed at provision; surface the cap."""
+        click.echo(
+            f"  → CW Sandbox lifetime is fixed at creation; '{sandbox_id}' is reaped at "
+            "its max_lifetime_seconds (override OMNIGENT_CWSANDBOX_MAX_LIFETIME_S)."
+        )
+
+    def run(self, sandbox_id: str, command: str, *, check: bool = True) -> RemoteCommandResult:
+        """Run ``bash -lc <command>`` in the sandbox and capture its output."""
+        handle = self._resolve(sandbox_id)
+        try:
+            result = handle.exec(["bash", "-lc", command]).result()
+        except Exception as exc:
+            # Catch broadly: besides CWSandboxError, .result() can raise a
+            # plain concurrent.futures.TimeoutError; both must surface as the
+            # launcher-contract ClickException, not leak to the caller raw.
+            raise click.ClickException(
+                f"Remote command failed to execute on sandbox '{sandbox_id}': {exc}"
+            ) from exc
+        for line in result.stdout.splitlines():
+            if line.strip():
+                click.echo(line)
+        if check and result.returncode != 0:
+            raise click.ClickException(
+                f"Remote command failed on sandbox '{sandbox_id}' "
+                f"(exit {result.returncode}): {command}"
+            )
+        return RemoteCommandResult(
+            returncode=result.returncode, stdout=result.stdout, stderr=result.stderr
+        )
+
+    def put(self, sandbox_id: str, local_path: Path, remote_path: str) -> None:
+        """Copy a local file into the sandbox via write_file."""
+        from cwsandbox.exceptions import CWSandboxError
+
+        try:
+            self._resolve(sandbox_id).write_file(remote_path, local_path.read_bytes()).result()
+        except CWSandboxError as exc:
+            raise click.ClickException(
+                f"File upload to sandbox '{sandbox_id}' failed: {exc}"
+            ) from exc
+
+    def stream_exec(self, sandbox_id: str, command: str, *, pty: bool = False) -> RemoteProcess:
+        """Spawn a command and stream its combined output line by line."""
+        handle = self._resolve(sandbox_id)
+        # exec returns separate stdout/stderr; merge in-shell for the
+        # combined-output RemoteProcess contract.
+        process = handle.exec(["bash", "-lc", f"{command} 2>&1"])
+        return _CWRemoteProcess(process)
+
+    def exec_foreground(self, sandbox_id: str, command: str) -> int:
+        """Run *command*, echo its output locally until exit; Ctrl-C kills it."""
+        handle = self._resolve(sandbox_id)
+        # Record the remote pid (process.cancel() can't kill the remote exec):
+        # `echo $$ … && exec` keeps the pid across the shell swap, so the
+        # interrupt path can kill it with a second exec.
+        remote = f"echo $$ > {_FOREGROUND_PIDFILE} && exec {command} 2>&1"
+        process = handle.exec(["bash", "-lc", remote])
+        try:
+            for line in process.stdout:
+                click.echo(line, nl=False)
+            return process.wait()
+        except KeyboardInterrupt:
+            click.echo("\n  → detaching; stopping the remote process")
+            handle.exec(["bash", "-lc", f"kill $(cat {_FOREGROUND_PIDFILE}) 2>/dev/null"]).wait()
+            raise
+
+    def wheel_install_command(self, remote_tgz_path: str) -> str:
+        """Overlay shipped wheels onto the prebaked host image."""
+        return host_image_wheel_install_command(remote_tgz_path)
+
+    def terminate(self, sandbox_id: str) -> None:
+        """Stop a sandbox; an already-gone sandbox is treated as success."""
+        _ensure_sdk()
+        from cwsandbox import Sandbox
+        from cwsandbox.exceptions import CWSandboxError, SandboxNotFoundError
+
+        try:
+            handle = self._sandboxes.get(sandbox_id) or Sandbox.from_id(sandbox_id).result()
+            handle.stop().result()
+        except SandboxNotFoundError:
+            pass  # Already gone — the desired end state holds.
+        except CWSandboxError as exc:
+            raise click.ClickException(f"Failed to stop CW Sandbox '{sandbox_id}': {exc}") from exc
+        self._sandboxes.pop(sandbox_id, None)
diff --git a/omnigent/server/managed_hosts.py b/omnigent/server/managed_hosts.py
index 271ba9cdd0..e6aaa7d330 100644
--- a/omnigent/server/managed_hosts.py
+++ b/omnigent/server/managed_hosts.py
@@ -120,8 +120,12 @@
 # managed session today. (Deployments that construct
 # ManagedSandboxConfig directly are not constrained by either set —
 # their launcher factory IS the support.)
-SUPPORTED_SANDBOX_PROVIDERS: frozenset[str] = frozenset({"lakebox", "modal", "daytona", "islo"})
-PROVIDERS_WITH_MANAGED_LAUNCH: frozenset[str] = frozenset({"modal", "daytona", "islo"})
+SUPPORTED_SANDBOX_PROVIDERS: frozenset[str] = frozenset(
+    {"lakebox", "modal", "daytona", "cwsandbox", "islo"}
+)
+PROVIDERS_WITH_MANAGED_LAUNCH: frozenset[str] = frozenset(
+    {"modal", "daytona", "cwsandbox", "islo"}
+)
 
 # How long a managed launch waits for the sandboxed host to register
 # before declaring failure. The image is pre-baked (no pip install at
@@ -153,6 +157,12 @@
 # as Daytona for long-lived hosts and stale-token cleanup.
 ISLO_MANAGED_TOKEN_TTL_S = 7 * 24 * 3600
 
+# The cwsandbox launch-token TTL is NOT a constant: CW Sandbox's lifetime is
+# operator-overridable (OMNIGENT_CWSANDBOX_MAX_LIFETIME_S), so the TTL is
+# derived from the resolved lifetime at parse time via
+# cwsandbox.managed_token_ttl_s() — always above the cap, so a live sandbox
+# can re-authenticate its tunnel across reconnects while a leaked token can't.
+
 # Where the in-sandbox host process logs — named in launch-failure
 # errors so an operator knows where to look inside the sandbox.
 _HOST_LOG_PATH = "/tmp/omnigent-host.log"
@@ -586,6 +596,15 @@ def parse_sandbox_config(raw: object) -> ManagedSandboxConfig | None:
             _parse_daytona_image(raw), _parse_daytona_env(raw)
         )
         token_ttl_s = DAYTONA_MANAGED_TOKEN_TTL_S
+    elif provider == "cwsandbox":
+        from omnigent.onboarding.sandboxes.cwsandbox import managed_token_ttl_s
+
+        launcher_factory = _cwsandbox_launcher_factory(
+            _parse_cwsandbox_image(raw), _parse_cwsandbox_env(raw)
+        )
+        # Derived from OMNIGENT_CWSANDBOX_MAX_LIFETIME_S so the token always
+        # outlives the (operator-overridable) sandbox lifetime.
+        token_ttl_s = managed_token_ttl_s()
     elif provider == "islo":
         launcher_factory = _islo_launcher_factory(
             image=_parse_provider_image(raw, "islo"),
@@ -789,6 +808,58 @@ def _parse_daytona_env(raw: dict[str, object]) -> list[str] | None:
     return [name.strip() for name in env]
 
 
+def _cwsandbox_launcher_factory(
+    image: str | None,
+    env: list[str] | None,
+) -> Callable[[], SandboxLauncher]:
+    """Build the launcher factory for the YAML ``provider: cwsandbox`` path."""
+
+    def _build() -> SandboxLauncher:
+        from omnigent.onboarding.sandboxes.cwsandbox import CWSandboxLauncher
+
+        return CWSandboxLauncher(image=image, env=env)
+
+    return _build
+
+
+def _parse_cwsandbox_image(raw: dict[str, object]) -> str | None:
+    """Extract and validate ``sandbox.cwsandbox.image`` (optional)."""
+    section = raw.get("cwsandbox")
+    if section is None:
+        return None
+    if not isinstance(section, dict):
+        raise ValueError("server config 'sandbox.cwsandbox' must be a mapping")
+    image = section.get("image")
+    if image is None:
+        return None
+    if not isinstance(image, str) or not image.strip():
+        raise ValueError(
+            "server config 'sandbox.cwsandbox.image' must be a registry image "
+            "reference with omnigent pre-installed (omit it to use the official image)"
+        )
+    return image.strip()
+
+
+def _parse_cwsandbox_env(raw: dict[str, object]) -> list[str] | None:
+    """Extract and validate ``sandbox.cwsandbox.env`` — server env var NAMES (optional)."""
+    section = raw.get("cwsandbox")
+    if section is None:
+        return None
+    if not isinstance(section, dict):
+        raise ValueError("server config 'sandbox.cwsandbox' must be a mapping")
+    env = section.get("env")
+    if env is None:
+        return None
+    if not isinstance(env, list) or not all(
+        isinstance(name, str) and name.strip() for name in env
+    ):
+        raise ValueError(
+            "server config 'sandbox.cwsandbox.env' must be a list of server "
+            "environment variable NAMES to inject, e.g. ['ANTHROPIC_API_KEY', 'GIT_TOKEN']"
+        )
+    return [name.strip() for name in env]
+
+
 def _islo_launcher_factory(
     *,
     image: str | None,
diff --git a/pyproject.toml b/pyproject.toml
index ae3867eb44..42781746ea 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -101,6 +101,10 @@ modal = ["modal>=1.0,<2"]
 # server-managed `sandbox.provider: daytona`).
 # Same lazy-import posture as the modal extra. Pre-1.0 SDK: pin minor.
 daytona = ["daytona>=0.180,<1"]
+# CoreWeave Sandbox launcher (`omnigent sandbox --provider cwsandbox` and
+# server-managed `sandbox.provider: cwsandbox`).
+# Same lazy-import posture as above. Pre-1.0 SDK: pin minor.
+cwsandbox = ["cwsandbox>=0.26,<1"]
 # MLflow tracing is opt-in: tracing is disabled by default and the
 # server degrades gracefully when mlflow is absent, so the (heavy) mlflow
 # dependency only installs for users who want it (`omnigent[tracing]`).
@@ -448,6 +452,12 @@ ignore_missing_imports = true
 module = "daytona.*"
 ignore_missing_imports = true
 
+# cwsandbox is an optional dep (the `cwsandbox` extra); same lazy-import
+# posture as modal above.
+[[tool.mypy.overrides]]
+module = "cwsandbox.*"
+ignore_missing_imports = true
+
 [[tool.mypy.overrides]]
 module = "prompt_toolkit.*"
 ignore_missing_imports = true
diff --git a/tests/e2e/integrations/deploy/cwsandbox/e2e_managed.py b/tests/e2e/integrations/deploy/cwsandbox/e2e_managed.py
new file mode 100644
index 0000000000..7668250c79
--- /dev/null
+++ b/tests/e2e/integrations/deploy/cwsandbox/e2e_managed.py
@@ -0,0 +1,417 @@
+#!/usr/bin/env python3
+"""
+End-to-end test: create a managed session against an Omnigent server, and have
+the agent run a REAL workload — an LLM turn against the CoreWeave / W&B inference
+endpoint — from inside the managed CHILD sandbox the server provisions.
+
+Two modes:
+
+  1. --server <url>: use an EXISTING omnigent server (already configured with
+     sandbox.provider=cwsandbox). No public-IP sandbox required — good for W&B
+     serverless users who can't expose a public service.
+
+         python tests/e2e/integrations/deploy/cwsandbox/e2e_managed.py \
+             --server http://my-omnigent:6767
+
+  2. (default) spin the server up inside a CW Sandbox with a public service. The
+     sandbox runs a prebaked image with this fork's omnigent + the cwsandbox SDK
+     (build/push first; pass --image), and the driver injects the LLM creds.
+
+         export CWSANDBOX_API_KEY=...        # provisions the sandboxes
+         export WANDB_INFERENCE_KEY=...      # the agent's LLM credential
+         python tests/e2e/integrations/deploy/cwsandbox/e2e_managed.py \
+             --image docker.io/<you>/omnigent-cwsandbox:test
+"""
+
+from __future__ import annotations
+
+import argparse
+import base64
+import json
+import os
+import sys
+import time
+
+import httpx
+from cwsandbox import NetworkOptions, Sandbox
+
+SERVER_PORT = 6767
+CONFIG_HOME = "/root/.omnigent"
+WANDB_BASE_URL = "https://api.inference.wandb.ai/v1"
+WANDB_MODEL = "Qwen/Qwen3-Coder-480B-A35B-Instruct"
+PROMPT = "What is 2+2? Reply with ONLY the number, nothing else."
+
+
+def _child_env(wandb_key: str) -> dict[str, str]:
+    """Env injected into every managed CHILD sandbox — the single source of truth.
+
+    The launcher forwards these by NAME from the server process env. OPENAI_*
+    reach the harness automatically; the HARNESS_* knobs ride
+    OMNIGENT_RUNNER_ENV_PASSTHROUGH. The config's `sandbox.cwsandbox.env` name
+    list and the server sandbox's env values both derive from this dict.
+    """
+    return {
+        "OPENAI_API_KEY": wandb_key,
+        "OPENAI_BASE_URL": WANDB_BASE_URL,
+        "HARNESS_OPENAI_AGENTS_MODEL": WANDB_MODEL,
+        # W&B is chat/completions-compatible, not the Responses API.
+        "HARNESS_OPENAI_AGENTS_USE_RESPONSES": "0",
+        # Tell the in-child host to forward the HARNESS_* knobs to the runner.
+        "OMNIGENT_RUNNER_ENV_PASSTHROUGH": (
+            "HARNESS_OPENAI_AGENTS_MODEL,HARNESS_OPENAI_AGENTS_USE_RESPONSES"
+        ),
+    }
+
+
+def log(msg: str) -> None:
+    print(msg, flush=True)
+
+
+def start_server_sandbox(image: str, cw_key: str, wandb_key: str) -> tuple[Sandbox, str]:
+    """Provision the server sandbox (public service) carrying the child-env values."""
+    log(f"[1/6] provisioning server sandbox from {image}")
+    sb = Sandbox.run(
+        "sleep",
+        "infinity",
+        container_image=image,
+        profile_names=["default"],
+        max_lifetime_seconds=3600,
+        resources={"cpu": "2", "memory": "4Gi"},
+        network=NetworkOptions(
+            ingress_mode="public", exposed_ports=[SERVER_PORT], egress_mode="internet"
+        ),
+        environment_variables={
+            "CWSANDBOX_API_KEY": cw_key,
+            "OMNIGENT_CWSANDBOX_HOST_IMAGE": image,
+            # Values the launcher passes through (by name) into each child:
+            **_child_env(wandb_key),
+        },
+        tags=["omnigent-e2e", "server"],
+    )
+    sb.wait()
+    ip = (sb.service_address or "").split(":")[0]
+    if not ip:
+        raise SystemExit(f"server sandbox {sb.sandbox_id} has no public service address")
+    log(f"      sandbox={sb.sandbox_id} public_ip={ip}")
+    return sb, ip
+
+
+def _write(sb: Sandbox, path: str, content: str) -> None:
+    b64 = base64.b64encode(content.encode()).decode()
+    sb.exec(
+        ["bash", "-lc", f"mkdir -p $(dirname {path}) && echo {b64} | base64 -d > {path}"]
+    ).result()
+
+
+def configure_and_start_server(sb: Sandbox, server_url: str, wandb_key: str) -> None:
+    """Write config + an openai-agents agent, then launch `omnigent server`."""
+    log(f"[2/6] starting omnigent server (server_url={server_url})")
+    child_env_names = ", ".join(_child_env(wandb_key))
+    _write(
+        sb,
+        f"{CONFIG_HOME}/config.yaml",
+        "sandbox:\n"
+        "  provider: cwsandbox\n"
+        f"  server_url: {server_url}\n"
+        "  cwsandbox:\n"
+        f"    env: [{child_env_names}]\n",
+    )
+    # Agent bound to the openai-agents harness + the W&B model. executor.auth
+    # (ApiKeyAuth) is what the runner's gateway routing reads for base_url +
+    # api_key — the bare OPENAI_BASE_URL env is ignored, so this is required
+    # to target W&B instead of defaulting to api.openai.com.
+    _write(
+        sb,
+        "/root/e2e-agent/agent.yaml",
+        "name: e2e-probe\n"
+        "prompt: You are a terse calculator. Answer with only the number.\n"
+        "executor:\n"
+        "  harness: openai-agents\n"
+        f"  model: {WANDB_MODEL}\n"
+        "  auth:\n"
+        "    type: api_key\n"
+        f"    api_key: {wandb_key}\n"
+        f"    base_url: {WANDB_BASE_URL}\n",
+    )
+    start = (
+        f"OMNIGENT_CONFIG_HOME={CONFIG_HOME} OMNIGENT_LOCAL_SINGLE_USER=1 "
+        f"setsid nohup omnigent server --host 0.0.0.0 --port {SERVER_PORT} "
+        f"--config {CONFIG_HOME}/config.yaml --no-open --agent /root/e2e-agent "
+        "> /tmp/omnigent-server.log 2>&1 < /dev/null & echo started"
+    )
+    sb.exec(["bash", "-lc", start]).result()
+
+
+def wait_server_ready(base: str, sb: Sandbox | None, timeout_s: float = 120.0) -> dict:
+    log(f"[3/6] waiting for {base}/v1/info")
+    deadline = time.monotonic() + timeout_s
+    last = ""
+    while time.monotonic() < deadline:
+        try:
+            r = httpx.get(f"{base}/v1/info", timeout=5.0)
+            if r.status_code == 200:
+                log(f"      ready: {json.dumps(r.json())}")
+                return r.json()
+            last = f"HTTP {r.status_code}"
+        except httpx.HTTPError as exc:
+            last = str(exc)
+        time.sleep(3.0)
+    log(f"      not ready ({last}); server log:")
+    _dump_server_logs(sb)
+    raise SystemExit("server never became ready")
+
+
+def pick_agent(base: str, agent_id: str | None = None) -> str:
+    resp = httpx.get(f"{base}/v1/agents", timeout=10.0)
+    resp.raise_for_status()
+    agents = resp.json()["data"]
+    if not agents:
+        raise SystemExit("no agents registered on the server to bind a session to")
+    if agent_id:
+        chosen = next((a for a in agents if a.get("id") == agent_id), None)
+        if chosen is None:
+            raise SystemExit(f"agent_id {agent_id!r} not found on the server")
+    else:
+        chosen = next((a for a in agents if a.get("name") == "e2e-probe"), agents[0])
+    log(f"      agent_id={chosen['id']} ({chosen.get('name')})")
+    return chosen["id"]
+
+
+def create_managed_session(base: str, agent_id: str) -> str:
+    log("[4/6] creating managed session with a prompt")
+    body = {
+        "agent_id": agent_id,
+        "host_type": "managed",
+        "initial_items": [
+            {
+                "type": "message",
+                "data": {"role": "user", "content": [{"type": "input_text", "text": PROMPT}]},
+            }
+        ],
+    }
+    r = httpx.post(f"{base}/v1/sessions", json=body, timeout=180.0)
+    if r.status_code >= 300:
+        raise SystemExit(f"create session failed: HTTP {r.status_code}: {r.text[:600]}")
+    conv_id = r.json()["id"]
+    log(f"      session={conv_id}")
+    return conv_id
+
+
+def _dump_server_logs(sb: Sandbox | None) -> None:
+    if sb is None:
+        log("      (external server — check its own logs)")
+        return
+    out = sb.exec(
+        [
+            "bash",
+            "-lc",
+            "tail -50 ~/.omnigent/logs/cli-*.log 2>/dev/null; "
+            "echo '--- stdout ---'; tail -15 /tmp/omnigent-server.log",
+        ]
+    ).result()
+    log(out.stdout)
+
+
+def _omnigent_children() -> list:
+    """List sandboxes the launcher tags 'omnigent' (managed hosts); [] on error."""
+    try:
+        return Sandbox.list(tags=["omnigent"]).result()
+    except Exception as exc:
+        log(f"  (could not list child sandboxes: {exc})")
+        return []
+
+
+def dump_child_logs(exclude: set[str]) -> None:
+    """Dump runner/harness logs from a CHILD this run created (not in *exclude*)."""
+    # Scope to children NOT present before this run — never touch sandboxes
+    # belonging to other runs / deployments that share the 'omnigent' tag.
+    children = [c for c in _omnigent_children() if c.sandbox_id not in exclude]
+    running = [c for c in children if "RUNNING" in str(getattr(c, "status", "")).upper()]
+    target = (running or children or [None])[0]
+    if target is None:
+        log("  (no child sandbox found for this run)")
+        return
+    log(f"  --- child sandbox {target.sandbox_id} runner/harness logs ---")
+    try:
+        out = target.exec(
+            [
+                "bash",
+                "-lc",
+                "tail -60 ~/.omnigent/logs/*.log 2>/dev/null; echo '--- host log ---'; "
+                "tail -40 /tmp/omnigent-host.log 2>/dev/null",
+            ]
+        ).result()
+        log(out.stdout)
+    except Exception as exc:
+        log(f"  (could not read child logs: {exc})")
+
+
+def wait_host_online(
+    base: str, conv_id: str, sb: Sandbox | None, timeout_s: float = 360.0
+) -> bool:
+    log("[5/6] waiting for the managed host to register (child sandbox)")
+    deadline = time.monotonic() + timeout_s
+    while time.monotonic() < deadline:
+        try:
+            d = httpx.get(f"{base}/v1/sessions/{conv_id}", timeout=5.0).json()
+            if d.get("host_online"):
+                log(f"      ✓ host online: host_id={d.get('host_id')}")
+                log(f"        runner_id={d.get('runner_id')}")
+                return True
+            if d.get("last_task_error"):
+                log(f"      launch error: {d['last_task_error']}")
+                break
+        except httpx.HTTPError:
+            pass
+        time.sleep(5.0)
+    log("      host did not come online; server logs:")
+    _dump_server_logs(sb)
+    return False
+
+
+def _assistant_text(items: list[dict]) -> str:
+    """Extract concatenated assistant text from session items."""
+    out = []
+    for it in items:
+        if it.get("type") != "message":
+            continue
+        data = it.get("data") or {}
+        if data.get("role") != "assistant":
+            continue
+        for block in data.get("content") or []:
+            if isinstance(block, dict) and block.get("text"):
+                out.append(block["text"])
+            elif isinstance(block, str):
+                out.append(block)
+    return " ".join(out).strip()
+
+
+def wait_for_reply(
+    base: str,
+    conv_id: str,
+    sb: Sandbox | None,
+    pre_children: set[str],
+    timeout_s: float = 180.0,
+) -> str | None:
+    """Poll session items until the agent posts an assistant reply."""
+    log("[6/6] waiting for the agent to run the LLM turn and reply")
+    deadline = time.monotonic() + timeout_s
+    while time.monotonic() < deadline:
+        try:
+            d = httpx.get(f"{base}/v1/sessions/{conv_id}", timeout=5.0).json()
+            # Check for a failure FIRST — an error that arrives after partial
+            # assistant text must not be masked by returning that text.
+            if d.get("last_task_error"):
+                log(f"      task error: {d['last_task_error']}")
+                break
+            # Only accept the reply once the turn has FINISHED (status back to
+            # idle), so an intermediate/streaming block isn't a false PASS.
+            text = _assistant_text(d.get("items") or [])
+            if text and d.get("status") == "idle":
+                return text
+        except httpx.HTTPError:
+            pass
+        time.sleep(4.0)
+    log("      no reply.")
+    try:
+        items = httpx.get(f"{base}/v1/sessions/{conv_id}", timeout=5.0).json().get("items", [])
+        log(f"      raw items: {json.dumps(items)[:1500]}")
+    except httpx.HTTPError:
+        pass
+    log("      server logs:")
+    _dump_server_logs(sb)
+    if sb is not None:
+        log("      child sandbox logs:")
+        dump_child_logs(pre_children)
+    return None
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument(
+        "--server",
+        default=None,
+        help="Use an EXISTING omnigent server at this URL (e.g. http://host:6767) "
+        "instead of spinning one up in a CW sandbox. The server must already be "
+        "configured with sandbox.provider=cwsandbox. No public-IP sandbox needed.",
+    )
+    parser.add_argument(
+        "--image",
+        default=None,
+        help="Prebaked omnigent+cwsandbox image (required only when spinning up the server).",
+    )
+    parser.add_argument(
+        "--agent-id",
+        default=None,
+        help="Bind the session to this agent id (default: the seeded e2e-probe, "
+        "else the first registered agent). Useful with --server.",
+    )
+    parser.add_argument("--keep", action="store_true")
+    args = parser.parse_args()
+
+    external = args.server is not None
+    cw_key = os.environ.get("CWSANDBOX_API_KEY")
+    wandb_key = os.environ.get("WANDB_INFERENCE_KEY")
+    if not external:
+        # Self-hosted mode spins up the server sandbox + injects the LLM creds.
+        if not args.image:
+            print("ERROR: --image is required unless --server is given", file=sys.stderr)
+            return 2
+        if not cw_key or not wandb_key:
+            print("ERROR: set CWSANDBOX_API_KEY and WANDB_INFERENCE_KEY", file=sys.stderr)
+            return 2
+
+    sb: Sandbox | None = None
+    if external:
+        base = args.server.rstrip("/")
+        log(f"[*] using existing omnigent server at {base}")
+    else:
+        sb, ip = start_server_sandbox(args.image, cw_key, wandb_key)
+        base = f"http://{ip}:{SERVER_PORT}"
+
+    # Children carry the shared "omnigent" tag, so snapshot which ones already
+    # existed before this run — we only ever touch the ones WE cause to appear,
+    # never another run's / deployment's managed hosts.
+    pre_children = {c.sandbox_id for c in _omnigent_children()} if sb is not None else set()
+
+    reply = None
+    try:
+        if not external:
+            configure_and_start_server(sb, base, wandb_key)
+        wait_server_ready(base, sb)
+        agent_id = pick_agent(base, args.agent_id)
+        conv_id = create_managed_session(base, agent_id)
+        if wait_host_online(base, conv_id, sb):
+            reply = wait_for_reply(base, conv_id, sb, pre_children)
+    finally:
+        # Only tear down sandboxes WE created. An external server owns its own
+        # children, so leave them alone.
+        if sb is not None and not args.keep:
+            log(f"cleaning up server sandbox {sb.sandbox_id} + managed child(ren)")
+            try:
+                sb.stop().result()
+            except Exception as exc:
+                log(f"  warning: server cleanup failed: {exc}")
+            # Stop only children that appeared during this run (id not in the
+            # pre-run snapshot) — never another run's sandboxes.
+            for child in _omnigent_children():
+                if child.sandbox_id in pre_children:
+                    continue
+                try:
+                    child.stop().result()
+                    log(f"  stopped child {child.sandbox_id}")
+                except Exception as exc:
+                    log(f"  warning: child cleanup failed for {child.sandbox_id}: {exc}")
+
+    print("\n" + "=" * 60)
+    if reply:
+        print("E2E PASSED — agent ran a real LLM workload in the sandbox.")
+        print(f"Prompt: {PROMPT}")
+        print(f"Reply:  {reply!r}")
+        return 0
+    print("E2E FAILED — see logs above.")
+    return 1
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/tests/e2e/integrations/deploy/cwsandbox/smoke_test.py b/tests/e2e/integrations/deploy/cwsandbox/smoke_test.py
new file mode 100644
index 0000000000..40200c9335
--- /dev/null
+++ b/tests/e2e/integrations/deploy/cwsandbox/smoke_test.py
@@ -0,0 +1,245 @@
+#!/usr/bin/env python3
+"""
+Smoke test for the CoreWeave Sandbox (cwsandbox) provider.
+
+Talks directly to the CW Sandbox HTTP API to validate the
+primitives the managed-host launcher relies on: provision → RUNNING,
+unary exec, AddFile, public egress, detach survival (setsid nohup), and
+terminate.
+
+    export CWSANDBOX_API_KEY=...
+    python tests/e2e/integrations/deploy/cwsandbox/smoke_test.py [--image IMG] [--keep]
+
+Transport is curl (subprocess): the system Python's TLS may be too old
+to reach the API, while curl uses the OS's. Zero pip dependencies.
+"""
+
+from __future__ import annotations
+
+import argparse
+import base64
+import json
+import os
+import subprocess
+import sys
+import time
+from urllib.parse import quote
+
+DEFAULT_IMAGE = "python:3.11-slim"
+MAX_LIFETIME_S = 3600
+PROVISION_TIMEOUT_S = 300
+POLL_INTERVAL_S = 3.0
+
+
+class SmokeError(Exception):
+    """A smoke-test check failed."""
+
+
+class Client:
+    """CW Sandbox API client over curl (Bearer auth, JSON)."""
+
+    def __init__(self, base_url: str, api_key: str) -> None:
+        self._base = base_url.rstrip("/")
+        self._auth = f"Authorization: Bearer {api_key}"
+
+    def _request(self, method: str, path: str, op: str, body: dict | None = None) -> dict:
+        cmd = [
+            "curl",
+            "-sS",
+            "-X",
+            method,
+            f"{self._base}{path}",
+            "-H",
+            self._auth,
+            "-H",
+            "Accept: application/json",
+            "-w",
+            "\n%{http_code}",
+        ]
+        if body is not None:
+            cmd += ["-H", "Content-Type: application/json", "--data-binary", json.dumps(body)]
+        try:
+            proc = subprocess.run(cmd, capture_output=True, text=True, timeout=70.0)
+        except FileNotFoundError as exc:
+            raise SmokeError("curl not found on PATH") from exc
+        except subprocess.TimeoutExpired as exc:
+            raise SmokeError(f"{op} -> timed out") from exc
+        if proc.returncode != 0:
+            raise SmokeError(f"{op} -> curl failed: {proc.stderr.strip()[:300]}")
+        raw, _, status = proc.stdout.rpartition("\n")
+        if not status.isdigit() or int(status) >= 400:
+            raise SmokeError(f"{op} -> HTTP {status}: {raw[:500]}")
+        return json.loads(raw) if raw.strip() else {}
+
+    def provision(self, *, image: str, name: str) -> str:
+        body = {
+            "containerImage": image,
+            "command": "sleep",
+            "args": ["infinity"],
+            "resources": {"cpu": "1", "memory": "1Gi"},
+            "maxLifetimeSeconds": MAX_LIFETIME_S,
+            "network": {"egressMode": "internet"},  # egress defaults to none
+            "tags": ["omnigent-smoke", name],
+        }
+        return self._request("POST", "/v1beta2/sandboxes", "provision", body)["sandboxId"]
+
+    def wait_running(self, sandbox_id: str) -> None:
+        deadline = time.monotonic() + PROVISION_TIMEOUT_S
+        last = ""
+        while time.monotonic() < deadline:
+            payload = self._request("GET", f"/v1beta2/sandboxes/{sandbox_id}", "get")
+            status = payload.get("sandboxStatus", "")
+            if status != last:
+                print(f"    status: {status}")
+                last = status
+            if status == "SANDBOX_STATUS_RUNNING":
+                return
+            if status.startswith("SANDBOX_STATUS_") and status not in (
+                "SANDBOX_STATUS_CREATING",
+                "SANDBOX_STATUS_PENDING",
+                "SANDBOX_STATUS_UNSPECIFIED",
+            ):
+                raise SmokeError(f"terminal status {status}: {payload.get('statusReason', '?')}")
+            time.sleep(POLL_INTERVAL_S)
+        raise SmokeError(f"not RUNNING within {PROVISION_TIMEOUT_S}s (last={last})")
+
+    def exec(self, sandbox_id: str, command: str) -> tuple[int, str, str]:
+        result = self._request(
+            "POST",
+            f"/v1beta2/sandboxes/{sandbox_id}/exec",
+            "exec",
+            {"command": ["bash", "-lc", command], "maxTimeoutSeconds": 60},
+        ).get("result", {})
+        # exitCode is omitted from the response when it is 0 (zero default).
+        return (
+            int(result.get("exitCode", 0)),
+            _b64(result.get("stdout", "")),
+            _b64(result.get("stderr", "")),
+        )
+
+    def put_file(self, sandbox_id: str, path: str, contents: bytes) -> None:
+        payload = self._request(
+            "POST",
+            f"/v1beta2/sandboxes/{sandbox_id}/files",
+            "addFile",
+            {"filepath": path, "fileContents": base64.b64encode(contents).decode("ascii")},
+        )
+        if not payload.get("success", False):
+            raise SmokeError(f"addFile failed: {payload.get('errorMessage')}")
+
+    def get_file(self, sandbox_id: str, path: str) -> bytes:
+        payload = self._request(
+            "GET",
+            f"/v1beta2/sandboxes/{sandbox_id}/files/{quote(path, safe='')}",
+            "retrieveFile",
+        )
+        return base64.b64decode(payload.get("fileContents", ""))
+
+    def stop(self, sandbox_id: str) -> None:
+        self._request("POST", f"/v1beta2/sandboxes/{sandbox_id}/stop", "stop", {})
+
+
+def _b64(value: str) -> str:
+    try:
+        return base64.b64decode(value).decode("utf-8", errors="replace") if value else ""
+    except Exception:
+        return value
+
+
+def _check(failures: list[str], ok: bool, label: str) -> None:
+    print(f"    {'✓' if ok else '✗'} {label}")
+    if not ok:
+        failures.append(label)
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--image", default=DEFAULT_IMAGE)
+    parser.add_argument("--keep", action="store_true", help="don't terminate at the end")
+    args = parser.parse_args()
+
+    api_key = os.environ.get("CWSANDBOX_API_KEY")
+    if not api_key:
+        print("ERROR: set CWSANDBOX_API_KEY", file=sys.stderr)
+        return 2
+    base_url = os.environ.get("CWSANDBOX_BASE_URL", "https://api.cwsandbox.com")
+
+    client = Client(base_url, api_key)
+    name = f"smoke-{int(time.time())}"
+    print(f"▸ smoke test against {base_url}  image={args.image}  tag={name}")
+
+    sandbox_id: str | None = None
+    failures: list[str] = []
+    try:
+        print("\n[1/6] provision")
+        sandbox_id = client.provision(image=args.image, name=name)
+        print(f"    sandbox_id={sandbox_id}")
+        client.wait_running(sandbox_id)
+        _check(failures, True, "RUNNING")
+
+        print("\n[2/6] unary exec")
+        code, out, _ = client.exec(sandbox_id, 'printf %s "$HOME"; echo; uname -sm')
+        _check(failures, code == 0, "exec exit code 0")
+        _check(failures, out.strip() != "", "exec returned $HOME")
+
+        print("\n[3/6] AddFile (+ read-back via exec)")
+        marker = b"cwsandbox-omnigent-smoke\n"
+        client.put_file(sandbox_id, "/tmp/oa-smoke.txt", marker)
+        _, out, _ = client.exec(sandbox_id, "cat /tmp/oa-smoke.txt")
+        _check(failures, out.encode() == marker, "file readable via exec after AddFile")
+        # RetrieveFile-over-REST can't route an absolute {filepath}; reads
+        # (never needed by the launcher) go through exec+base64 instead.
+        try:
+            ok = client.get_file(sandbox_id, "/tmp/oa-smoke.txt") == marker
+            print(f"    {'✓' if ok else 'ℹ'} RetrieveFile REST (bonus): {'works' if ok else 'no'}")
+        except SmokeError:
+            print("    ℹ RetrieveFile REST unsupported for absolute paths (expected)")
+
+        print("\n[4/6] public egress (outbound https from inside)")
+        code, out, _ = client.exec(
+            sandbox_id,
+            'python3 -c "import urllib.request as u; '
+            "print(u.urlopen('https://api.github.com', timeout=15).status)\"",
+        )
+        _check(failures, code == 0 and "200" in out, "outbound HTTPS reached api.github.com")
+
+        print("\n[5/6] detach survives exec session (setsid nohup ... &)")
+        client.exec(sandbox_id, "rm -f /tmp/oa-detach-alive")
+        client.exec(
+            sandbox_id,
+            "setsid nohup sh -c 'sleep 4; echo alive > /tmp/oa-detach-alive' "
+            "> /tmp/oa-detach.log 2>&1 < /dev/null & echo launched",
+        )
+        time.sleep(7)
+        _, out, _ = client.exec(sandbox_id, "cat /tmp/oa-detach-alive 2>/dev/null")
+        _check(failures, out.strip() == "alive", "detached process kept running after exec")
+
+        print("\n[6/6] terminate")
+        if args.keep:
+            print(f"    --keep set; leaving {sandbox_id} running")
+        else:
+            client.stop(sandbox_id)
+            _check(failures, True, "stop accepted")
+            sandbox_id = None
+    except SmokeError as exc:
+        failures.append(f"FATAL: {exc}")
+    finally:
+        if sandbox_id is not None and not args.keep:
+            try:
+                client.stop(sandbox_id)
+                print(f"\n  (cleaned up {sandbox_id})")
+            except Exception as exc:
+                print(f"\n  WARNING: failed to clean up {sandbox_id}: {exc}")
+
+    print("\n" + "=" * 60)
+    if failures:
+        print("SMOKE TEST FAILED:")
+        for f in failures:
+            print(f"  ✗ {f}")
+        return 1
+    print("SMOKE TEST PASSED — every managed-host primitive works.")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/tests/onboarding/sandboxes/test_cwsandbox.py b/tests/onboarding/sandboxes/test_cwsandbox.py
new file mode 100644
index 0000000000..db328caf02
--- /dev/null
+++ b/tests/onboarding/sandboxes/test_cwsandbox.py
@@ -0,0 +1,211 @@
+"""Tests for :mod:`omnigent.onboarding.sandboxes.cwsandbox`."""
+
+from __future__ import annotations
+
+import sys
+import types
+from dataclasses import dataclass, field
+from pathlib import Path
+
+import click
+import pytest
+
+from omnigent.onboarding.sandboxes.base import DEFAULT_HOST_IMAGE
+from omnigent.onboarding.sandboxes.cwsandbox import (
+    HOST_IMAGE_ENV_VAR,
+    SANDBOX_ENV_PASSTHROUGH_ENV_VAR,
+    CWSandboxLauncher,
+)
+
+# ── Fake cwsandbox SDK ──────────────────────────────────────
+#
+# The SDK is an optional dependency the test env may not install, and
+# real Sandbox objects only exist server-side — so these are hand-rolled
+# stubs injected via sys.modules, resolving the launcher's function-local
+# `import cwsandbox` / `from cwsandbox.exceptions import ...`.
+
+
+class _CWSandboxError(Exception):
+    pass
+
+
+class _SandboxNotFoundError(_CWSandboxError):
+    pass
+
+
+@dataclass
+class _FakeNetworkOptions:
+    egress_mode: str | None = None
+    ingress_mode: str | None = None
+    exposed_ports: tuple[int, ...] | None = None
+
+
+@dataclass
+class _FakeResult:
+    stdout: str = ""
+    stderr: str = ""
+    returncode: int = 0
+
+
+class _FakeOp:
+    """Stands in for an OperationRef: `.result()` returns the value."""
+
+    def __init__(self, value: object = None) -> None:
+        self._value = value
+
+    def result(self, timeout: float | None = None) -> object:
+        return self._value
+
+
+class _FakeProcess:
+    def __init__(self, result: _FakeResult) -> None:
+        self._result = result
+        self.cancelled = False
+
+    @property
+    def stdout(self):
+        return iter(self._result.stdout.splitlines(keepends=True))
+
+    def result(self, timeout: float | None = None) -> _FakeResult:
+        return self._result
+
+    def wait(self, timeout: float | None = None) -> int:
+        return self._result.returncode
+
+    def cancel(self) -> bool:
+        self.cancelled = True
+        return True
+
+
+@dataclass
+class _State:
+    """Shared recorder for assertions."""
+
+    run_kwargs: dict = field(default_factory=dict)
+    run_command: tuple = ()
+    written: list[tuple[str, bytes]] = field(default_factory=list)
+    stopped: list[str] = field(default_factory=list)
+    exec_result: _FakeResult = field(default_factory=_FakeResult)
+    from_id_missing: bool = False
+
+
+class _FakeSandbox:
+    _state: _State
+
+    def __init__(self, sandbox_id: str = "sb-1") -> None:
+        self._sandbox_id = sandbox_id
+
+    @property
+    def sandbox_id(self) -> str:
+        return self._sandbox_id
+
+    @classmethod
+    def run(cls, *command, **kwargs) -> _FakeSandbox:
+        cls._state.run_command = command
+        cls._state.run_kwargs = kwargs
+        return cls()
+
+    @classmethod
+    def from_id(cls, sandbox_id: str) -> _FakeOp:
+        if cls._state.from_id_missing:
+            raise _SandboxNotFoundError(sandbox_id)
+        return _FakeOp(cls(sandbox_id))
+
+    def wait(self, timeout: float | None = None) -> _FakeSandbox:
+        return self
+
+    def exec(self, command, **kwargs) -> _FakeProcess:
+        return _FakeProcess(self._state.exec_result)
+
+    def write_file(self, path: str, data: bytes) -> _FakeOp:
+        self._state.written.append((path, data))
+        return _FakeOp(None)
+
+    def stop(self) -> _FakeOp:
+        self._state.stopped.append(self._sandbox_id)
+        return _FakeOp(None)
+
+
+@pytest.fixture()
+def sdk(monkeypatch: pytest.MonkeyPatch) -> _State:
+    state = _State()
+    _FakeSandbox._state = state
+
+    mod = types.ModuleType("cwsandbox")
+    mod.Sandbox = _FakeSandbox  # type: ignore[attr-defined]
+    mod.NetworkOptions = _FakeNetworkOptions  # type: ignore[attr-defined]
+    exc = types.ModuleType("cwsandbox.exceptions")
+    exc.CWSandboxError = _CWSandboxError  # type: ignore[attr-defined]
+    exc.SandboxNotFoundError = _SandboxNotFoundError  # type: ignore[attr-defined]
+
+    monkeypatch.setitem(sys.modules, "cwsandbox", mod)
+    monkeypatch.setitem(sys.modules, "cwsandbox.exceptions", exc)
+    monkeypatch.setenv("CWSANDBOX_API_KEY", "cw-test-key")
+    monkeypatch.delenv(HOST_IMAGE_ENV_VAR, raising=False)
+    monkeypatch.delenv(SANDBOX_ENV_PASSTHROUGH_ENV_VAR, raising=False)
+    return state
+
+
+def test_prepare_requires_api_key(sdk: _State, monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.delenv("CWSANDBOX_API_KEY")
+    with pytest.raises(click.ClickException, match="CWSANDBOX_API_KEY"):
+        CWSandboxLauncher().prepare()
+
+
+def test_provision_requests_host_image_and_egress(sdk: _State) -> None:
+    assert CWSandboxLauncher().provision("managed-x") == "sb-1"
+    assert sdk.run_command == ("sleep", "infinity")
+    assert sdk.run_kwargs["container_image"] == DEFAULT_HOST_IMAGE
+    assert sdk.run_kwargs["network"].egress_mode == "internet"
+    assert sdk.run_kwargs["tags"] == ["omnigent", "managed-x"]
+
+
+def test_provision_image_resolution_order(sdk: _State, monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setenv(HOST_IMAGE_ENV_VAR, "ghcr.io/env/override:1")
+    CWSandboxLauncher(image="ghcr.io/explicit/img:2").provision("x")
+    assert sdk.run_kwargs["container_image"] == "ghcr.io/explicit/img:2"
+
+
+def test_provision_env_passthrough_from_server_env(
+    sdk: _State, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    monkeypatch.setenv("ANTHROPIC_API_KEY", "sk-ant-123")
+    CWSandboxLauncher(env=["ANTHROPIC_API_KEY"]).provision("x")
+    assert sdk.run_kwargs["environment_variables"] == {"ANTHROPIC_API_KEY": "sk-ant-123"}
+
+
+def test_provision_env_passthrough_missing_var_fails_loud(sdk: _State) -> None:
+    with pytest.raises(click.ClickException, match="NOT_SET_ANYWHERE"):
+        CWSandboxLauncher(env=["NOT_SET_ANYWHERE"]).provision("x")
+
+
+def test_run_returns_output_and_exit_code(sdk: _State) -> None:
+    sdk.exec_result = _FakeResult(stdout="hi\n", returncode=0)
+    result = CWSandboxLauncher().run("sb-1", "echo hi")
+    assert result.returncode == 0 and result.stdout == "hi\n"
+
+
+def test_run_raises_on_nonzero_when_checked(sdk: _State) -> None:
+    sdk.exec_result = _FakeResult(returncode=3)
+    launcher = CWSandboxLauncher()
+    with pytest.raises(click.ClickException, match="exit 3"):
+        launcher.run("sb-1", "false")
+    assert launcher.run("sb-1", "false", check=False).returncode == 3
+
+
+def test_put_writes_bytes(sdk: _State, tmp_path: Path) -> None:
+    local = tmp_path / "wheels.tgz"
+    local.write_bytes(b"binary\x00data")
+    CWSandboxLauncher().put("sb-1", local, "/tmp/wheels.tgz")
+    assert sdk.written == [("/tmp/wheels.tgz", b"binary\x00data")]
+
+
+def test_terminate_swallows_not_found(sdk: _State) -> None:
+    sdk.from_id_missing = True
+    CWSandboxLauncher().terminate("already-gone")  # must not raise
+    assert sdk.stopped == []
+
+
+def test_terminate_stops_existing(sdk: _State) -> None:
+    CWSandboxLauncher().terminate("sb-1")
+    assert sdk.stopped == ["sb-1"]
diff --git a/uv.lock b/uv.lock
index 42d1a153e9..f601834c28 100644
--- a/uv.lock
+++ b/uv.lock
@@ -11,6 +11,9 @@ resolution-markers = [
 exclude-newer = "0001-01-01T00:00:00Z" # This has no effect and is included for backwards compatibility when using relative exclude-newer values.
 exclude-newer-span = "P7D"
 
+[options.exclude-newer-package]
+cwsandbox = "2026-06-12T00:00:00Z"
+
 [[package]]
 name = "aiofiles"
 version = "24.1.0"
@@ -745,6 +748,20 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/d2/f1/00ce3bde3ca542d1acd8f8cfa38e446840945aa6363f9b74746394b14127/cryptography-46.0.7-cp38-abi3-win_amd64.whl", hash = "sha256:506c4ff91eff4f82bdac7633318a526b1d1309fc07ca76a3ad182cb5b686d6d3", size = 3472985, upload-time = "2026-04-08T01:57:36.714Z" },
 ]
 
+[[package]]
+name = "cwsandbox"
+version = "0.26.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "googleapis-common-protos" },
+    { name = "grpcio" },
+    { name = "protobuf" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/ef/d9/540f20685c878f86f8588bff841618e1a125bfb13c8ba4071fe9e041477d/cwsandbox-0.26.0.tar.gz", hash = "sha256:541fbef6fd5cf7b70e2692bf3f35a2ae8f2a577e5caf29162dececb42e973616", size = 489383, upload-time = "2026-06-11T13:09:00.329Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/67/61/ac962e3c59d3c349046d204a67c5f301b10ebab4c413b079862fd234a7d5/cwsandbox-0.26.0-py3-none-any.whl", hash = "sha256:88143a5959a93f1a0145a7897d57caabe9c488051e287f185da1a83451896105", size = 178221, upload-time = "2026-06-11T13:08:58.751Z" },
+]
+
 [[package]]
 name = "cycler"
 version = "0.12.1"
@@ -2482,6 +2499,9 @@ bedrock = [
     { name = "boto3" },
     { name = "botocore" },
 ]
+cwsandbox = [
+    { name = "cwsandbox" },
+]
 databricks = [
     { name = "databricks-mcp" },
     { name = "databricks-sdk" },
@@ -2530,6 +2550,7 @@ requires-dist = [
     { name = "cel-expr-python", specifier = ">=0.1" },
     { name = "claude-agent-sdk", specifier = ">=0.1.62" },
     { name = "click", specifier = ">=8.0,<8.2" },
+    { name = "cwsandbox", marker = "extra == 'cwsandbox'", specifier = ">=0.26,<1" },
     { name = "databricks-mcp", marker = "extra == 'databricks'", specifier = ">=0.1.0" },
     { name = "databricks-sdk", marker = "extra == 'all'", specifier = ">=0.56.0,<1" },
     { name = "databricks-sdk", marker = "extra == 'databricks'", specifier = ">=0.56.0,<1" },
@@ -2584,7 +2605,7 @@ requires-dist = [
     { name = "types-pyyaml", marker = "extra == 'dev'", specifier = ">=6.0" },
     { name = "uvicorn", extras = ["standard"], specifier = ">=0.30,<1" },
 ]
-provides-extras = ["claude-sdk", "openai-agents", "all", "bedrock", "vertex", "modal", "daytona", "tracing", "agents-sdk", "databricks", "dev"]
+provides-extras = ["claude-sdk", "openai-agents", "all", "bedrock", "vertex", "modal", "daytona", "cwsandbox", "tracing", "agents-sdk", "databricks", "dev"]
 
 [[package]]
 name = "omnigent-client"
diff --git a/uv.toml b/uv.toml
index d8e571f753..90042c2eb1 100644
--- a/uv.toml
+++ b/uv.toml
@@ -11,3 +11,10 @@ required-version = ">=0.11.8"
 # only re-applied when a resolution actually runs (`uv lock`, `--upgrade`,
 # `--refresh`, or a dependency change).
 exclude-newer = "P7D"
+
+# Per-package cooldown exemption: cwsandbox is a first-party CoreWeave SDK
+# pinned to an exact, tested version (the `cwsandbox` extra). Exempt just this
+# package from the P7D cooldown so the lock can pin 0.26.0 before the window
+# elapses; the global cooldown still applies to every other dependency. Drop
+# this once 0.26.0 (published 2026-06-11) has aged past P7D.
+exclude-newer-package = { cwsandbox = "2026-06-12T00:00:00Z" }