Entrypoint

Entrypoint is a bash script that runs inside the agent's sandbox after secrets load and before the runtime boots. Use it to prepare the environment the agent needs before it starts working.

What entrypoint is for

• Install dependencies: Run package managers, install system packages, or build generated assets.
• Clone or prepare code: Fetch a repository, check out a branch, or create folders the agent expects.
• Configure the sandbox: Write config files, set permissions, or warm caches before the harness starts.

Write an entrypoint

Keep the script idempotent: it should be safe to run more than once. In the UI, leaving the editor empty means the agent has no entrypoint. In the CLI manifest, set exactly one of entrypoint.file, entrypoint.commands, or entrypoint.text.

set -euo pipefail

if [ ! -d repo ]; then
  git clone https://github.com/acme/internal-tools.git repo
fi

cd repo
npm ci
npm run build

Use secrets

Secrets are available before the entrypoint runs, so the script can use them for package registries, private repositories, or setup commands. Read them from environment variables and avoid printing them to logs.

set -euo pipefail

git clone "https://oauth2:${GITHUB_TOKEN}@github.com/acme/private-repo.git" repo
cd repo
npm ci

Best practices

• Keep setup fast; slow entrypoints delay every task startup.
• Make commands repeatable and safe if the sandbox already has the file or package.
• Use Secrets for tokens and private configuration.
• Avoid destructive commands unless the agent needs a clean environment every time.
• Prefer pinned package versions for predictable behavior.