Agent sessions are defined in code, and can be spawned via CLI, API, in response to webhook events, or on a cron. All the benefits of cloud agents included: isolated sandbox, dependencies installed, full logging, permission limits, and budget caps.
The prompt, the trigger, the repositories it clones, and its spend caps live in one file. Creating or changing it is a pull request, live on merge, so the review process you already have becomes the change-control process for your automation.
ellipsis: version: v1 name: Nightly migration checker description: Run splitshift-api's migration checks nightlyclaude: system: | Run `make check-migrations` in splitshift-api. If it fails, identify the migration at fault and open an issue with the failing output and the likely fix.trigger: type: cron schedule: "0 3 * * *"sandbox: repositories: - name: splitshift-api variables: - name: DOPPLER_TOKENbudget: session: 1.50Prompt, trigger, repos, and caps in one committed file
Each session gets its own container with your repositories cloned and gh authenticated. Dependency installs bake into a cached image, so the nightly run boots the snapshot in seconds instead of installing from scratch, and nothing it writes reaches the next session.
sandbox: image: setup: | poetry install pnpm install --frozen-lockfileDependency installs baked into a cached image
Every tool call, every turn, and the exact instructions the agent launched with are recorded, with cost and duration per step. An automation nobody watched is still fully auditable, and the whole history downloads as first-party records.
Every turn and tool call, with cost per step
One query covers transcripts, recaps, and the pull requests your automations produced, by keyword or by meaning. Months of unattended work becomes something the team can ask questions of instead of a folder of logs.
Investigated webhook retry storms after the queue migration
Added idempotency keys to the trade-webhook consumer
One query across every transcript and recap
Scope each agent's GitHub token down to read-only, or to a single repository. GitHub enforces the narrowing when the token is minted, so nothing running in the sandbox can exceed it, and every credential is revoked at teardown.
sandbox: github: permissions: contents: write pull_requests: write repositories: [splitshift-docs]Permissions minted per session, enforced by GitHub
Cap what one session can spend, and what this agent can spend across a day, a week, or a month. A session that reaches its cap stops cleanly and records budget_hit, which is not an error, and a run blocked by a trailing limit never gets a sandbox at all.
budget: session: 1.50 day: 5.00 week: 20.00 month: 60.00Hard caps per session, agent, and developer