[enjoycgr]

Summary

Deployments without LaunchDarkly (self-hosted, E2B Embed) can't turn on filesystem-only-checkpoint. The flag is hardwired to false, so createSnapshot({ mode: 'filesystem' }) is always refused with snapshot_filesystem_only_disabled. This adds the same env fallback that PAUSE_REFUSAL_RESTORE and CREATE_MEMORY_REFUSAL already have:

-	FilesystemOnlyCheckpointFlag = NewBoolFlag("filesystem-only-checkpoint", false)
+	FilesystemOnlyCheckpointFlag = NewBoolFlag("filesystem-only-checkpoint", envBoolOr("FILESYSTEM_ONLY_CHECKPOINT", false))

Both the API (snapshot_template_create.go) and the orchestrator (server/sandboxes.go) read the flag, so an operator sets the variable on both. Unset, nothing changes. docs/ARCHITECTURE.md names the variable, the same way it does for the neighbouring flags.

Embed is not changed here. Its compose turns on reliability knobs unconditionally, and whether to expose this one is the maintainers' call.

Evidence

• Before: on a self-hosted stack without LaunchDarkly, a filesystem-only snapshot request gets 400 snapshot_filesystem_only_disabled. The only workaround is patching the default to true and rebuilding the API and orchestrator. I run that patch on a self-hosted Amp orb host, where filesystem-only project snapshots save in under a second and new sandboxes cold-boot from them.

• After: with FILESYSTEM_ONLY_CHECKPOINT set, the flag's fallback comes from the env:

  FILESYSTEM_ONLY_CHECKPOINT	fallback
  unset	false
  true / 1	true
  false / garbage	false

  go test -race ./pkg/featureflags/... (in packages/shared): ok. gofmt -l: clean. make lint was not run locally.

Merge Danger

Door: two-way

Behaviour changes only when the variable is set, and LaunchDarkly values still take precedence where LaunchDarkly is configured.

Blast Radius: minimal

The existing placement floor (0.16.202609301732) still refuses nodes too old to run the feature.

🤖 Generated with Claude Code

[cla-bot]

We require contributors to sign our Contributor License Agreement, and we don't have @enjoycgr on file. You can sign our CLA at https://e2b.dev/docs/cla . Once you've signed, post a comment here that says '@cla-bot check'