Turn E2B sandbox crashes into Linear bugs in real time

Build me a webhook-triggered agent workflow that turns unexpected E2B sandbox deaths into Linear bug tickets in real time, with a short Slack heads up so on-call engineers actually see them.

Trigger: an incoming webhook from E2B for sandbox.lifecycle.killed events. E2B supports outgoing webhooks for sandbox lifecycle events signed with a shared HMAC secret, so during setup I want to register the webhook against my E2B team and have the workflow verify the signature on every incoming request before doing any work.

When a kill event arrives, do this:

1. Use Get Sandbox Lifecycle Events to pull the timeline for that sandbox, and Get Sandbox Logs to pull the tail of console output. If useful, call Get Sandbox to grab metadata like the template id, alias, started-at, and any owning agent name stored in the sandbox metadata.

2. Decide whether the kill looks intentional or like a real crash. Intentional: a clean user-initiated kill, an expected TTL expiry, or a normal shutdown at the end of a task. Crash: non-zero exit code, OOM signal, abrupt termination mid-task, or any abnormal lifecycle reason. Silently drop the intentional kills, do not file anything, do not Slack anything.

3. For crashes, dedupe first. Use Linear Search Issues (or List Issues with a filter) to look for an open issue labelled sandbox-crash whose title matches the same template id, created inside the last hour. If one exists, add a Linear comment on that issue summarising this new occurrence (sandbox id, time, one-line reason from the lifecycle event) and exit without filing a new ticket and without sending a new Slack ping.

4. If there is no recent duplicate, use Linear Create Issue in the designated engineering team. Title: 'E2B sandbox crash on {template_id}'. Description in Markdown should include: sandbox id, template id and alias, owning agent name, runtime so far, the abnormal lifecycle event (with reason and exit code if present), and the last ~50 lines of console output in a fenced code block. Apply the 'sandbox-crash' label and set a sensible default priority.

5. Use Slack Bot Send a Message to post a short alert in the on-call channel: one line with the template id and reason, plus a link to the new Linear issue. Keep it tight, this is a triage ping, not a report.

Configurable knobs I want exposed at setup: which Linear team, label, and default priority the bug lands on, which Slack channel gets the alert (with optional per-template routing), the dedupe window (default 1 hour), and the exact patterns that count as 'crash' versus 'intentional' so we can tune false positives without editing the workflow.

Keep the agent strictly reactive: one incoming kill event in, at most one Linear write and one Slack write out. Never create executions for sandboxes the agent did not start, and never act on lifecycle events other than killed.