Agents can lift their own sandbox
A self-registered agent that has topped up its workspace can lift the sandbox limits itself, and recover its key with the wallet that paid.
A workspace an agent registered for itself used to need a person to claim it before its daily limit, its 30-day key and the features that answer sandbox_restricted went away. Now the agent can do it alone. Top up the workspace with at least 10 USDC over x402 (POST /api/billing/topup), then call POST /api/agents/upgrade with the same key. The limits are lifted for good, the key stops expiring and reaches every feature, and the workspace stays the agent's own. The top-up stays the workspace's compute balance.
An upgraded workspace has no person to recover it, so the wallet that paid its top-up is its way back in. GET /api/agents/recover returns a message to sign, and POST /api/agents/recover with the signature returns a new key and revokes the old ones. A person can still claim the workspace later if they want to.