From a482a3fac147bc72e5ec3af1a2527e0c10a4f352 Mon Sep 17 00:00:00 2001
From: centdix <40307056+centdix@users.noreply.github.com>
Date: Tue, 24 Feb 2026 20:57:07 +0100
Subject: [PATCH] internal: nit workmux sandbox

---
 .wmdev.yaml | 38 +++++++++++++++-----------------------
 1 file changed, 15 insertions(+), 23 deletions(-)

diff --git a/.wmdev.yaml b/.wmdev.yaml
index 02f60e2a01..0707f107f6 100644
--- a/.wmdev.yaml
+++ b/.wmdev.yaml
@@ -4,29 +4,27 @@ services:
   - name: FE
     portEnv: FRONTEND_PORT
 
-sandbox:
-  image: windmill-sandbox
-  envPassthrough:
-    - AWS_ACCESS_KEY_ID
-    - AWS_SECRET_ACCESS_KEY
-    - R2_ENDPOINT
-    - R2_BUCKET
-    - R2_PUBLIC_URL
-  extraMounts:
-    - hostPath: ~/.codex
-      guestPath: /root/.codex
-      writable: true
-    - hostPath: ~/windmill-ee-private
-      writable: true
-    - hostPath: ~/windmill-ee-private__worktrees
-      writable: true
-
 profiles:
   default:
     name: default
 
   sandbox:
     name: sandbox
+    image: windmill-sandbox
+    envPassthrough:
+      - AWS_ACCESS_KEY_ID
+      - AWS_SECRET_ACCESS_KEY
+      - R2_ENDPOINT
+      - R2_BUCKET
+      - R2_PUBLIC_URL
+    extraMounts:
+      - hostPath: ~/.codex
+        guestPath: /root/.codex
+        writable: true
+      - hostPath: ~/windmill-ee-private
+        writable: true
+      - hostPath: ~/windmill-ee-private__worktrees
+        writable: true
     systemPrompt: >
       You are running inside a sandboxed container with full permissions.
       This worktree is configured with the following ports:
@@ -75,9 +73,3 @@ profiles:
       3) Upload to asciinema.org:
           XDG_DATA_HOME=/tmp/.local/share \
             asciinema upload --server-url https://asciinema.org /tmp/demo.cast
-    envPassthrough:
-      - AWS_ACCESS_KEY_ID
-      - AWS_SECRET_ACCESS_KEY
-      - R2_ENDPOINT
-      - R2_BUCKET
-      - R2_PUBLIC_URL