Agno 3.1.5 Makes Sandbox Checkpoints Portable Across Replicas

What shipped

Agno 3.1.5, released 19 October 2026, makes sandboxed agent work more portable across sessions and replicas. The release adds repository workspaces for sandboxed ClaudeAgent and CodexAgent runs: the first turn pins a commit, later turns preserve that pin and edits across warm reuse and checkpoint restore, and private repositories use GITHUB_READ_TOKEN from the sandbox environment.

It also adds an S3-compatible S3CheckpointStore. The release notes say checkpoint objects are content-addressed and verified before put returns, allowing sandbox replicas to use object storage instead of a shared filesystem. A sandboxed agent can expose a completed run checkpoint through open_run_checkpoint / aopen_run_checkpoint, so a host can inspect what a finished turn left behind after its container is gone.

The same release adds on-demand schedules: an omitted or empty cron_expr does not arm a schedule, and it runs only through its trigger route. It also rejects keyless web fetches that resolve to private or loopback addresses in the new Keenable tools.

Why this matters

These are state and boundary contracts, not just convenience APIs. Repository pinning gives a resumed coding task an explicit starting point; verified object-store checkpoints give operators a durable handoff between ephemeral sandboxes; and an on-demand schedule separates “registered” from “armed.” The security implication is narrower but important: a URL fetcher that refuses private and loopback destinations reduces one class of server-side request exposure. None of these guarantees replaces host-level sandboxing, credential scoping, or an audit of the surrounding deployment.

What I verified

I read the v3.1.5 release notes and compared the v3.1.4…v3.1.5 source range. I downloaded the published agno==3.1.5 wheel from PyPI without installing it; the artifact contains agno/sandbox/s3.py, agno/sandbox/repository.py, and the open_run_checkpoint implementation in agno/agents/base.py. This was source and artifact inspection only: I did not run a sandbox, connect to S3, or exercise a private-repository checkout.

The practical test for adopters is a restart matrix: pin a repository, modify it, checkpoint, destroy the worker, restore on another replica, and verify the commit pin, working-tree edits, archive integrity, and credential boundaries independently.