`POST /sandboxes/{id}/exec`

Runs a command in the guest and streams the result as length-prefixed frames ([type:1][reserved:3][size:4 BE][payload]) where type is stdout, stderr, or exit; the exit payload is a JSON ExecResult. Set ?stdin=1 for a hijacked, full-duplex interactive exec.

### Authorizations

- `bearerAuth` — HTTP bearer. Daemon API key. Omit on a keyless loopback daemon.

### Path parameters

- `id` string · required — Sandbox ID, e.g. sbx_ab12cd34.

### Query parameters

- `stdin` string · optional — Set to "1" for an interactive, full-duplex exec (hijacked stream).

### Request body

`application/json`

- `cmd` array of string | null · optional
- `cwd` string · optional
- `env` object · optional
- `timeout_s` integer · optional

### Responses

**200** — OK

`application/octet-stream`:

**400** — Bad Request

`application/json`:

- `error` string · optional

**404** — Not Found

`application/json`:

- `error` string · optional