feat: add sandbox agent core — reasoning, execution, graph

[Ladas]

Summary

New LangGraph-based sandbox agent with:

• Multi-step reasoning with thinking iterations and configurable budget
• A2A server with event streaming and session management
• Graph state machine with conditional routing and per-node tool subsets
• AgentGraphCard for runtime graph topology introspection
• Landlock filesystem isolation (ctypes-only, zero deps)
• Context builders, event serializer, permissions, plan store
• OTel observability with GenAI semantic conventions

21 files | Part of Sandbox Agent streaming PR series

In general, the best fix is to avoid hand-written regexes for HTML sanitization and instead use a well-tested HTML parser or sanitizer that correctly handles case-insensitive tag names and malformed tag syntax. Here, since the goal is just to strip scripts/styles and then all tags for readability, we can use Python’s standard html.parser or a small, well-known library, or minimally harden the regexes to be case-insensitive and more tolerant of odd closing tags.

The smallest change that fixes the reported issue without altering overall functionality is:

• Make the <script> and <style> patterns case-insensitive by using re.IGNORECASE.
• Make the closing tag patterns more forgiving so that </script foo="bar"> and similar variants are also stripped, not just exact </script> or </style>. This can be done by allowing optional trailing attributes on the closing tag.
• Leave the rest of the pipeline (removing all other tags, collapsing whitespace, truncation) unchanged.

Concretely, in a2a/sandbox_agent/src/sandbox_agent/graph.py, within the web_fetch function’s HTML handling block (lines ~533–541), update the two re.sub calls that strip script and style blocks. We can keep using the local import re but change the patterns and flags to:

• r"(?is)<script\b[^>]*>.*?</script\b[^>]*>" (or equivalently pass flags=re.DOTALL | re.IGNORECASE instead of using (?is) inline).
• r"(?is)<style\b[^>]*>.*?</style\b[^>]*>".

This makes the tag matching case-insensitive (i) and dot match newlines (s), and accepts extra junk on the closing tag. We’ll still use explicit flags since that’s the existing style.