Microsoft.Agents.AI.Hyperlight

Microsoft.Agents.AI.Hyperlight

First-class CodeAct support for the Microsoft Agent Framework, backed by the Hyperlight VM-isolated sandbox.

The package exposes two entry points:

• HyperlightCodeActProvider — an AIContextProvider that injects an execute_code tool and CodeAct guidance into every agent invocation. Only one HyperlightCodeActProvider may be attached to a given agent; it enforces this through a fixed StateKeys value so ChatClientAgent's state-key uniqueness validation rejects duplicate registrations.
• HyperlightExecuteCodeFunction — a standalone AIFunction for static/manual wiring when the sandbox configuration is fixed for the agent's lifetime.

Both surfaces support:

• Provider-owned tools exposed inside the sandbox via call_tool(...) (multiple allowed).
• Opt-in filesystem mounts and outbound network allow-list.
• CodeActApprovalMode control: NeverRequire (default; approval propagates from tools wrapped in ApprovalRequiredAIFunction) and AlwaysRequire.
• Snapshot/restore per run so the guest starts from a known clean state every invocation.

Requirements

• The Hyperlight.HyperlightSandbox.Api NuGet package, published from the src/sdk/dotnet SDK in hyperlight-dev/hyperlight-sandbox (the .NET API was added in PR #46, now merged). Until the package is published to nuget.org the project restore will fail; this project is intentionally IsPackable=false in the meantime.
• A Hyperlight Python guest module when using SandboxBackend.Wasm.

Network access and guest packages

HyperlightCodeActProviderOptions.AllowedDomains controls outbound requests from the sandbox. It does not install guest packages or expose host-installed dependencies to guest code.

CreateForWasm(modulePath) selects an existing .wasm or .aot guest module; it does not build a guest or install Python packages. The Agent Framework integration does not provide a custom guest build or package installation workflow. Package availability depends on the selected module and backend; the default JavaScript backend does not run Python code.

For operations requiring application dependencies or external APIs, register an AIFunction in Tools and invoke it from the guest with call_tool(...). Keep credentials and authorization in the host function. These functions run outside the guest, so AllowedDomains does not restrict their network requests; enforce any required destination policy in the host function.

Status

Preview. API may change until the underlying Hyperlight SDK reaches a stable release.