sandbox.commands.run as a function tool so every command the agent generates runs in an isolated VM instead of on your machine.
Setup
OPENAI_API_KEY from your local environment. Only the commands that the agent runs go to the sandbox.
Wire the sandbox into the agent
The highlighted block defines abash tool backed by the sandbox. Everything else is standard OpenAI Agents SDK usage.