Sandcastle on Render Workflows

Deploy Sandcastle on Render Workflows to turn labelled GitHub issues into pull requests, each written by a coding agent in its own Render Sandbox.

Why deploy Sandcastle on Render?

Sandcastle is Matt Pocock's open-source TypeScript library for orchestrating AI coding agents in isolated sandboxes: you call sandcastle.run(), an agent works on a branch inside a sandbox, and its commits come back to your repo. It solves the problem of running coding agents unattended, so they can work through issues in parallel without touching your machine or your credentials.

This template runs Sandcastle as a durable software factory on Render. A Render Workflows service plans which labelled issues can be worked on at the same time, then fans out one task per issue, each with its own compute, retries, and timeout. Every agent runs in a disposable Render Sandbox through a Sandcastle sandbox provider included in the template, so there's no Docker host to run and no sandbox lifecycle to manage. The workflow pushes each branch and opens the pull request itself, and your Render and GitHub tokens never enter a sandbox.

Architecture

What you can build

After deploying, you'll have a workflow that you point at a GitHub repo and an issue label. A planner agent reads the labelled issues and picks up to five that won't conflict with each other. Then one Claude Code agent per issue resolves it on its own branch, in its own sandbox, and the workflow opens one pull request per issue that closes it. Trigger it from your terminal, from your own app with the Render SDK, or nightly from a cron job, and review the pull requests in the morning.

Key features

• Durable fan-out on Render Workflows: A factory task runs plan, then one implement task per issue in parallel, each with its own compute, retry, and timeout of up to 24 hours.
• Render Sandboxes provider for Sandcastle: renderSandbox() implements Sandcastle's isolated provider contract with streamed output, stdin, and file sync, and terminates each sandbox when its task ends.
• Credentials stay on the host: The agent commits inside the sandbox, and the workflow pushes and opens the pull request, so the Render and GitHub tokens are never visible to agent code.
• Conflict-aware planning: An Opus planner reads the codebase and picks issues that won't touch the same code, and a Sonnet implementer works each one on a deterministic sandcastle/issue-<n> branch, so a retry updates the same pull request.
• Agent-ready deploy runbook: docs/deploy.md takes a coding agent from a fresh clone to a first pull request, and npm run doctor checks every credential and deploy step without printing a secret.

Use cases

• Maintainer clears a backlog of small, well-scoped issues with a nightly run
• Platform team runs unattended coding agents without giving them GitHub or cloud credentials
• Developer moves Sandcastle's parallel-planner pattern from a local Docker setup to managed infrastructure
• Engineer learns Render Workflows fan-out and Render Sandboxes from a working end-to-end example

What's included

Prerequisites

• Render API key and workspace ID: Used by the workflow to create and drive Render Sandboxes in your workspace.
• GitHub token: Fine-grained token for the target repo with Contents and Pull requests read and write, and Issues read. Used to read issues, push branches, and open pull requests.
• Claude Code OAuth token: Created with claude setup-token on a Claude Pro or Max plan. The only credential passed into the sandbox, where the agent uses it.

Next steps

1. From a clone of your copy with .env filled in, run npm run import-image — You should see Image sbb-... is ready. within about 90 seconds, confirming the sandcastle-node sandbox image exists in your workspace
2. Label one small issue sandcastle in a repo you own, then run npm run trigger -- owner/repo — Within about three minutes you should see JSON with "status": "opened" and a pullRequestUrl, and the pull request should say Closes #<issue>
3. Label two or three unrelated issues and trigger again — You should see one plan run followed by parallel implement runs on the workflow's page in the Render Dashboard, each with its own logs, and one pull request per issue

Resources

• Sandcastle on GitHub: https://github.com/mattpocock/sandcastle
• Render Workflows docs: https://render.com/docs/workflows
• Render Sandboxes docs: https://render.com/docs/sandboxes