OneDrive

Mount Microsoft OneDrive into a sandbox with the onedrive backend. Everything the agent writes to the mount persists to OneDrive (via the Microsoft Graph API) and survives restarts. Configure it as an entry in SandboxConfig.fs; access under the mount is governed by ACLs.

Authenticate

Supply an OAuth access token. Pair it with a refresh token plus client credentials so the backend can renew the access token automatically.

index.ts

import { getOrCreateSandbox } from "@hiver.sh/client";

const sandbox = await getOrCreateSandbox("onedrive", {
  fs: [{
    backend: "onedrive",
    mount: "/drive",
    onedrive_access_token: process.env.ONEDRIVE_ACCESS_TOKEN!,
    onedrive_refresh_token: process.env.ONEDRIVE_REFRESH_TOKEN,
    onedrive_client_id: process.env.ONEDRIVE_CLIENT_ID,
    onedrive_client_secret: process.env.ONEDRIVE_CLIENT_SECRET,
    onedrive_prefix: "sandbox/run-1", // optional; scopes to a subfolder
    acls: [{ path: "/drive/**", access: "rw" }],
  }],
});

import { getOrCreateSandbox } from "@hiver.sh/client";

const sandbox = await getOrCreateSandbox("onedrive", {
  fs: [{
    backend: "onedrive",
    mount: "/drive",
    onedrive_access_token: process.env.ONEDRIVE_ACCESS_TOKEN!,
    onedrive_refresh_token: process.env.ONEDRIVE_REFRESH_TOKEN,
    onedrive_client_id: process.env.ONEDRIVE_CLIENT_ID,
    onedrive_client_secret: process.env.ONEDRIVE_CLIENT_SECRET,
    onedrive_prefix: "sandbox/run-1", // optional; scopes to a subfolder
    acls: [{ path: "/drive/**", access: "rw" }],
  }],
});

Fields

Field	Description
`onedrive_access_token`	OAuth access token. Required.
`onedrive_refresh_token`	OAuth refresh token, used to renew the access token automatically.
`onedrive_client_id` / `onedrive_client_secret`	OAuth application credentials from your Entra ID (Azure AD) app registration.
`onedrive_tenant`	Optional. Microsoft identity platform tenant used for token refresh. Defaults to `common`.
`onedrive_drive_id`	Optional. Target a specific drive, e.g. a SharePoint document library. Omit to use the signed-in user's OneDrive.
`onedrive_prefix`	Optional subfolder path the mount is scoped to (created if absent).

Getting OAuth tokens, register an app in Entra ID and run the Microsoft identity platform OAuth 2.0 flow with the Files.ReadWrite.All offline_access scopes. The onedrive_refresh_token keeps the access token fresh automatically.

Scoping with a prefix, set onedrive_prefix to keep a sandbox confined to a subfolder rather than the whole drive; the folder is created if it does not exist.

Combine a OneDrive mount with other backends in the same sandbox, for example a read-write local /workspace for scratch plus a /drive mount for durable output. Mount paths must be unique and non-overlapping. See Local Files, GCS, S3, Azure Blob, and Google Drive.

Next: Snapshots