AbstractRuntime 0.10.1__tar.gz → 0.10.2__tar.gz

{abstractruntime-0.10.1 → abstractruntime-0.10.2}/CHANGELOG.md

@@ -5,6 +5,28 @@ All notable changes to AbstractRuntime will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.10.2] - 2026-10-16
+
+### Changed
+
+- **Code nodes can import Python's standard library.** In the `sandbox` permission mode, `import json`, `re`,
+  `datetime`, `math`, `collections`, `itertools`, `statistics`, `textwrap`, `hashlib`, `urllib.parse`… now
+  work, at the top of the code and inside functions, in both the RestrictedPython lane and the fallback lane, and
+  inside the function bodies of flow function libraries. The sandbox still refuses third-party packages, private
+  (`_`-prefixed) modules, and the standard-library modules that reach the machine or go around the sandbox's own
+  checks: processes and the operating system (`os`, `subprocess`, `threading`, `signal`, `ctypes`, `platform`…), files (`io`,
+  `pathlib`, `shutil`, `tempfile`, `glob`, `sqlite3`, `logging`, and the parsers that read a file by path: `xml`,
+  `configparser`, `argparse`…), the network (`socket`, `http`, `urllib.request`, `smtplib`…), code loading or
+  interpreter internals (`sys`, `importlib`, `pickle`, `types`, `inspect`…) and attribute access by name,
+  evaluated annotations or frames (`operator`, `typing`, `functools`, `traceback`). A refusal names the module
+  and the reason; `from x import *`, relative imports and the `__import__` call stay refused.
+- **A Code node's return value must be JSON data.** `transform` returning a module, a function, a set, bytes or
+  any other value JSON cannot carry now fails with a sandbox error naming the value and where it sits
+  (`transform returned a value that cannot be sent as JSON: module 'time' at output[2]`), in every permission
+  mode, instead of a serializer crash later in the gateway's simulate reply or the run's persisted state. `full_access` (host policy) imports anything, as before.
+  The rule is applied twice: at compile time by `validate_code`, and at run time by the `__import__` bound into
+  the sandbox builtins. `get_code_execution_policy()` now lists `imports.denied_modules` for thin clients.
+
 ## [0.10.1] - 2026-10-16
 
 ### Changed

{abstractruntime-0.10.1 → abstractruntime-0.10.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: AbstractRuntime
-Version: 0.10.1
+Version: 0.10.2
 Summary: AbstractRuntime: a durable graph runner designed to pair with AbstractCore.
 Project-URL: AbstractCore (website), https://www.abstractcore.ai/
 Project-URL: AbstractRuntime (GitHub), https://github.com/lpalbou/abstractruntime

{abstractruntime-0.10.1 → abstractruntime-0.10.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "AbstractRuntime"
-version = "0.10.1"
+version = "0.10.2"
 description = "AbstractRuntime: a durable graph runner designed to pair with AbstractCore."
 readme = "README.md"
 requires-python = ">=3.10"

abstractruntime-0.10.2/release-notes.md

@@ -0,0 +1,19 @@
+### Changed
+
+- **Code nodes can import Python's standard library.** In the `sandbox` permission mode, `import json`, `re`,
+  `datetime`, `math`, `collections`, `itertools`, `statistics`, `textwrap`, `hashlib`, `urllib.parse`… now
+  work, at the top of the code and inside functions, in both the RestrictedPython lane and the fallback lane, and
+  inside the function bodies of flow function libraries. The sandbox still refuses third-party packages, private
+  (`_`-prefixed) modules, and the standard-library modules that reach the machine or go around the sandbox's own
+  checks: processes and the operating system (`os`, `subprocess`, `threading`, `signal`, `ctypes`, `platform`…), files (`io`,
+  `pathlib`, `shutil`, `tempfile`, `glob`, `sqlite3`, `logging`, and the parsers that read a file by path: `xml`,
+  `configparser`, `argparse`…), the network (`socket`, `http`, `urllib.request`, `smtplib`…), code loading or
+  interpreter internals (`sys`, `importlib`, `pickle`, `types`, `inspect`…) and attribute access by name,
+  evaluated annotations or frames (`operator`, `typing`, `functools`, `traceback`). A refusal names the module
+  and the reason; `from x import *`, relative imports and the `__import__` call stay refused.
+- **A Code node's return value must be JSON data.** `transform` returning a module, a function, a set, bytes or
+  any other value JSON cannot carry now fails with a sandbox error naming the value and where it sits
+  (`transform returned a value that cannot be sent as JSON: module 'time' at output[2]`), in every permission
+  mode, instead of a serializer crash later in the gateway's simulate reply or the run's persisted state. `full_access` (host policy) imports anything, as before.
+  The rule is applied twice: at compile time by `validate_code`, and at run time by the `__import__` bound into
+  the sandbox builtins. `get_code_execution_policy()` now lists `imports.denied_modules` for thin clients.

{abstractruntime-0.10.1 → abstractruntime-0.10.2}/src/abstractruntime/visualflow_compiler/visual/code_executor.py

@@ -8,8 +8,10 @@ without importing the web backend implementation.
 from __future__ import annotations
 
 import ast
+import builtins as _builtins
 import os
-from typing import Any, Callable, Dict
+import sys
+from typing import Any, Callable, Dict, Optional
 
 # Try to import RestrictedPython, fall back to basic execution if not available
 try:
@@ -83,6 +85,173 @@ if RESTRICTED_PYTHON_AVAILABLE:
             super().check_name(node, name, allow_magic_methods)
 
 
+# ---------------------------------------------------------------------------
+# Imports in the sandbox: Python's own standard library, except the modules
+# that reach outside the interpreter. One rule for the AST check at compile
+# time (validate_code) and the ``__import__`` guard at run time (the guard is
+# what actually gates: the AST check only makes the refusal early and clear).
+# ---------------------------------------------------------------------------
+
+# Top-level standard-library modules the sandbox refuses, each with the reason
+# shown to the author. Grouped by what the module reaches.
+SANDBOX_DENIED_MODULES: Dict[str, str] = {
+    # processes, the OS, the interpreter
+    **{m: "processes and the operating system" for m in (
+        "os", "posix", "nt", "posixpath", "ntpath", "genericpath", "subprocess", "multiprocessing",
+        "threading", "_thread", "concurrent", "asyncio", "signal", "ctypes", "resource", "pwd", "grp",
+        "pty", "tty", "termios", "fcntl", "pipes", "crypt", "spwd", "nis", "syslog", "mmap", "msvcrt",
+        "winreg", "winsound", "ossaudiodev", "locale", "getpass", "readline", "rlcompleter", "cmd",
+        "atexit", "faulthandler", "gc", "webbrowser", "antigravity", "this", "turtle", "turtledemo",
+        "tkinter", "curses", "idlelib",
+        # runs uname/sw_vers and reads /etc/os-release to answer
+        "platform",
+    )},
+    # files on the machine
+    **{m: "files on the machine" for m in (
+        "io", "pathlib", "shutil", "tempfile", "glob", "fileinput", "linecache", "filecmp", "zipfile",
+        "tarfile", "gzip", "bz2", "lzma", "dbm", "shelve", "sqlite3", "codecs", "logging", "wave", "aifc",
+        "sunau", "chunk", "sndhdr", "imghdr", "tokenize", "mailbox", "mailcap", "netrc", "uu", "cgi",
+        "cgitb", "pyclbr", "tabnanny",
+        # parsers and readers that take a file PATH (xml.*.parse, configparser.read,
+        # argparse's @argument-files, gettext's catalogs)
+        "xml", "pyexpat", "configparser", "argparse", "optparse", "gettext",
+        # read_mime_types(path) / MimeTypes.read(path)
+        "mimetypes",
+    )},
+    # the network
+    **{m: "the network" for m in (
+        "socket", "ssl", "select", "selectors", "socketserver", "http", "ftplib", "poplib", "imaplib",
+        "smtplib", "smtpd", "nntplib", "telnetlib", "xmlrpc", "wsgiref", "asynchat", "asyncore",
+    )},
+    # loading or running code, interpreter internals
+    **{m: "loading or running code" for m in (
+        "sys", "builtins", "importlib", "pkgutil", "runpy", "zipimport", "modulefinder", "code", "codeop",
+        "compileall", "py_compile", "marshal", "pickle", "pickletools", "copyreg", "types", "inspect",
+        "dis", "site", "sysconfig", "timeit", "doctest", "unittest", "pdb", "bdb", "trace", "profile",
+        "cProfile", "pstats", "tracemalloc", "test", "lib2to3", "pydoc", "pydoc_data", "ensurepip", "venv",
+        "zipapp", "distutils", "msilib", "__main__", "opcode", "symtable",
+    )},
+    # around the sandbox's own checks: attribute access by NAME (which the dunder
+    # rule cannot see), evaluation of annotation strings, access to frames
+    **{m: "around the sandbox's checks (attributes by name, evaluated annotations, frames)" for m in (
+        "operator", "typing", "functools", "traceback",
+    )},
+}
+
+# A refused package whose one pure submodule is allowed: ``urllib.parse``
+# (URL parsing) is fine, ``urllib.request`` is the network.
+SANDBOX_ALLOWED_SUBMODULES: frozenset = frozenset({"urllib.parse"})
+
+_STDLIB_MODULE_NAMES: frozenset = frozenset(getattr(sys, "stdlib_module_names", ()))
+
+
+def sandbox_import_reason(name: str) -> Optional[str]:
+    """Why the sandbox refuses importing ``name`` — or None when it is allowed.
+
+    Allowed: a module of Python's own standard library whose top-level package
+    is not in SANDBOX_DENIED_MODULES (plus the listed pure submodules of a
+    refused package). Refused: everything else — third-party packages, private
+    (``_``-prefixed) modules, and the standard-library modules that reach
+    processes, files, the network or code loading. ``full_access`` (host
+    policy) lifts every limit.
+    """
+    dotted = str(name or "").strip()
+    if not dotted:
+        return "an empty module name"
+    if dotted in SANDBOX_ALLOWED_SUBMODULES:
+        return None
+    top = dotted.split(".", 1)[0]
+    if top == "__future__":
+        return None
+    if top.startswith("_"):
+        return "a private module"
+    reason = SANDBOX_DENIED_MODULES.get(top)
+    if reason is not None:
+        return f"it reaches {reason}"
+    if top == "urllib":
+        return "it reaches the network; only urllib.parse is importable"
+    if top not in _STDLIB_MODULE_NAMES:
+        return "only Python's own standard library is importable"
+    return None
+
+
+def sandbox_import_check(name: str, fromlist: Any = ()) -> None:
+    """Raise CodeExecutionError when the sandbox refuses importing ``name``.
+
+    ``fromlist`` are the names of a ``from name import a, b`` statement: a
+    refused package is still fine when every one of them is an allowed
+    submodule (``from urllib import parse``).
+    """
+    reason = sandbox_import_reason(name)
+    if reason is not None and fromlist and all(
+        isinstance(item, str) and f"{name}.{item}" in SANDBOX_ALLOWED_SUBMODULES for item in fromlist
+    ):
+        reason = None
+    if reason is not None:
+        raise CodeExecutionError(
+            f"import of '{name}' is not allowed in the sandbox: {reason} "
+            "(full_access lifts this limit)"
+        )
+
+
+def _sandbox_import(name: str, globals: Any = None, locals: Any = None, fromlist: Any = (), level: int = 0) -> Any:
+    """The sandbox's ``__import__``: the same rule as validate_code, applied
+    to the name that is actually imported at run time (relative imports are
+    refused: there is no package for them to be relative to)."""
+    if level:
+        raise CodeExecutionError("relative imports are not allowed in the sandbox")
+    sandbox_import_check(name, tuple(fromlist or ()))
+    return _builtins.__import__(name, globals, locals, fromlist or (), 0)
+
+
+def sandbox_builtins(base: Any) -> Dict[str, Any]:
+    """A copy of ``base`` builtins with the sandbox's ``__import__`` bound."""
+    out: Dict[str, Any] = dict(base)
+    out["__import__"] = _sandbox_import
+    return out
+
+
+def _json_offender(value: Any, path: str = "output") -> Optional[tuple]:
+    """The first value inside ``value`` that JSON cannot carry, as (path, type name)."""
+    if value is None or isinstance(value, (bool, int, float, str)):
+        return None
+    if isinstance(value, (list, tuple)):
+        for i, item in enumerate(value):
+            found = _json_offender(item, f"{path}[{i}]")
+            if found:
+                return found
+        return None
+    if isinstance(value, dict):
+        for key, item in value.items():
+            if not isinstance(key, (str, int, float, bool)) and key is not None:
+                return (f"{path} (key {key!r})", type(key).__name__)
+            found = _json_offender(item, f"{path}[{key!r}]")
+            if found:
+                return found
+        return None
+    name = type(value).__name__
+    if name == "module":
+        name = f"module '{getattr(value, '__name__', '?')}'"
+    elif name in ("function", "builtin_function_or_method", "method"):
+        name = f"function '{getattr(value, '__name__', '?')}'"
+    return (path, name)
+
+
+def ensure_json_result(value: Any, function_name: str = "transform") -> Any:
+    """Return ``value`` when JSON can carry it; otherwise raise a CodeExecutionError
+    that names the offending value and where it sits, so the author sees
+    "return os_time, not the module" instead of a serializer crash later
+    (the gateway's simulate reply, or the run's persisted state)."""
+    found = _json_offender(value)
+    if found is None:
+        return value
+    path, name = found
+    raise CodeExecutionError(
+        f"{function_name} returned a value that cannot be sent as JSON: {name} at {path}. "
+        "Return data: str, int, float, bool, None, lists and dicts of those."
+    )
+
+
 def normalize_code_permissions(permissions: Any = "sandbox") -> str:
     """Return the canonical Code node execution permission mode."""
     raw = str(permissions or "sandbox").strip().lower().replace("-", "_")
@@ -129,8 +298,17 @@ def get_code_execution_policy() -> Dict[str, Any]:
                 "label": "Sandbox",
                 "available": True,
                 "default": True,
-                "safety": "restricted_python",
-                "description": "Protected Python execution with imports and unsafe constructs disabled.",
+                "safety": "restricted_python" if RESTRICTED_PYTHON_AVAILABLE else "basic",
+                "description": (
+                    "Protected Python execution: Python's standard library is importable, except the "
+                    "modules that reach processes, files, the network or code loading; exec/eval, "
+                    "dunder access and third-party packages are refused."
+                ),
+                "imports": {
+                    "allowed": "python standard library",
+                    "denied_modules": sorted(SANDBOX_DENIED_MODULES),
+                    "allowed_submodules": sorted(SANDBOX_ALLOWED_SUBMODULES),
+                },
             },
             {
                 "id": "full_access",
@@ -163,13 +341,24 @@ def validate_code(code: str) -> None:
         raise CodeExecutionError(f"Syntax error: {e}") from e
 
     for node in ast.walk(tree):
-        # Disallow imports
-        if isinstance(node, (ast.Import, ast.ImportFrom)):
-            raise CodeExecutionError("Imports are not allowed")
-
-        # Disallow exec/eval
+        # Imports: Python's own standard library, minus the modules that reach
+        # the machine (sandbox_import_check); the run-time __import__ guard
+        # applies the same rule to whatever is actually imported.
+        if isinstance(node, ast.Import):
+            for alias in node.names:
+                sandbox_import_check(alias.name)
+        elif isinstance(node, ast.ImportFrom):
+            if node.level:
+                raise CodeExecutionError("relative imports are not allowed in the sandbox")
+            if any(alias.name == "*" for alias in node.names):
+                raise CodeExecutionError(f"'from {node.module} import *' is not allowed in the sandbox")
+            sandbox_import_check(node.module or "", tuple(alias.name for alias in node.names))
+
+        # Disallow exec/eval/compile and the dynamic import call (write `import x`)
         if isinstance(node, ast.Call) and isinstance(node.func, ast.Name):
-            if node.func.id in ("exec", "eval", "compile", "__import__"):
+            if node.func.id == "__import__":
+                raise CodeExecutionError("'__import__' is not allowed in the sandbox: write `import <module>` instead")
+            if node.func.id in ("exec", "eval", "compile"):
                 raise CodeExecutionError(f"'{node.func.id}' is not allowed")
 
         # Disallow dunder attributes
@@ -214,9 +403,10 @@ def _create_full_access_handler(code: str, function_name: str) -> Callable[[Any]
             raise CodeExecutionError(f"'{function_name}' is not a callable function")
 
         try:
-            return func(input_data)
+            result = func(input_data)
         except Exception as e:
             raise CodeExecutionError(f"Runtime error: {e}") from e
+        return ensure_json_result(result, function_name)
 
     return handler
 
@@ -259,10 +449,11 @@ def _apply(func: Any, *args: Any, **kwargs: Any) -> Any:
 def _sandbox_parse_json(text: Any) -> Any:
     """``parse_json(text)`` — the sandbox's JSON reader.
 
-    The sandbox has no imports, so JSON parsing was impossible in code nodes
-    and would have been impossible in pin expressions (the design verdict's
-    amendment 4: "parser" helpers were unbuildable inline). Errors stay in
-    the CodeExecutionError family so they surface loudly with attribution.
+    Pin expressions have no imports, and code nodes had none when this helper
+    was added (the design verdict's amendment 4: "parser" helpers were
+    unbuildable inline); it stays the one-call JSON reader of both sandboxes.
+    Errors stay in the CodeExecutionError family so they surface loudly with
+    attribution.
     """
     import json
 
@@ -433,7 +624,7 @@ def _create_restricted_handler(code: str, function_name: str) -> Callable[[Any],
 
     def handler(input_data: Any) -> Any:
         restricted_globals = {
-            "__builtins__": safe_builtins,
+            "__builtins__": sandbox_builtins(safe_builtins),
             "_getiter_": default_guarded_getiter,
             "_getitem_": default_guarded_getitem,
             "_iter_unpack_sequence_": guarded_iter_unpack_sequence,
@@ -473,9 +664,10 @@ def _create_restricted_handler(code: str, function_name: str) -> Callable[[Any],
             raise CodeExecutionError(f"'{function_name}' is not a callable function")
 
         try:
-            return func(input_data)
+            result = func(input_data)
         except Exception as e:
             raise CodeExecutionError(f"Runtime error: {e}") from e
+        return ensure_json_result(result, function_name)
 
     return handler
 
@@ -494,11 +686,13 @@ def _create_basic_handler(code: str, function_name: str) -> Callable[[Any], Any]
         limited_globals = {
             "__builtins__": {
                 # Same convenience set as the restricted lane (one source),
-                # plus the literal names bare exec needs.
+                # plus the literal names bare exec needs and the sandbox's
+                # __import__ (standard library only, see sandbox_import_check).
                 **sandbox_helper_globals(),
                 "True": True,
                 "False": False,
                 "None": None,
+                "__import__": _sandbox_import,
             }
         }
 
@@ -528,8 +722,9 @@ def _create_basic_handler(code: str, function_name: str) -> Callable[[Any], Any]
             raise CodeExecutionError(f"'{function_name}' is not a callable function")
 
         try:
-            return func(input_data)
+            result = func(input_data)
         except Exception as e:
             raise CodeExecutionError(f"Runtime error: {e}") from e
+        return ensure_json_result(result, function_name)
 
     return handler

{abstractruntime-0.10.1 → abstractruntime-0.10.2}/src/abstractruntime/visualflow_compiler/visual/function_library.py

@@ -70,6 +70,7 @@ from .code_executor import (
     CodeExecutionError,
     _apply,
     _inplacevar,
+    sandbox_builtins,
     sandbox_helper_globals,
     validate_code,
 )
@@ -152,11 +153,12 @@ def _validate_library_purity(name: str, code: str) -> None:
     construction, so the process-lifetime shared namespace can never leak
     state across runs/tenants. Build-time, loud, attributed by function name.
 
-    FIRST runs the SAME ``validate_code`` the code-node lane uses (imports,
-    exec/eval/compile/__import__, dunder-attribute access) — one source, no
-    drift ("one sandbox, one rule"). The library lane previously skipped it
-    and let in-body imports fail only at CALL time; now it refuses at build
-    exactly like a code node. The purity rules below are the tier-2 ADDITION
+    FIRST runs the SAME ``validate_code`` the code-node lane uses (imports
+    outside Python's standard library or of the modules that reach the
+    machine, exec/eval/compile/__import__, dunder-attribute access) — one
+    source, no drift ("one sandbox, one rule"). The library lane previously
+    skipped it and let in-body imports fail only at CALL time; now it refuses
+    at build exactly like a code node. The purity rules below are the tier-2 ADDITION
     on top of that shared baseline.
     """
     try:
@@ -232,7 +234,7 @@ def compile_function_library(
     # mirrors the code-node sandbox EXACTLY (one sandbox, one rule) or bodies
     # die at call time with bare sandbox-internal NameErrors.
     shared_ns: Dict[str, Any] = {
-        "__builtins__": safe_builtins,
+        "__builtins__": sandbox_builtins(safe_builtins),  # + the sandbox __import__ (standard library)
         "_getiter_": default_guarded_getiter,
         "_getitem_": default_guarded_getitem,
         "_iter_unpack_sequence_": guarded_iter_unpack_sequence,

abstractruntime-0.10.2/tests/test_code_node_imports.py

@@ -0,0 +1,212 @@
+"""Imports in the Code-node sandbox: Python's own standard library, except the
+modules that reach the machine (processes, files, network, code loading).
+
+One rule, applied twice: validate_code refuses at compile time (early, clear
+message), and the sandbox's ``__import__`` refuses at run time (what actually
+gates, in both the RestrictedPython lane and the basic fallback lane).
+"""
+
+from __future__ import annotations
+
+import pytest
+
+from abstractruntime.visualflow_compiler.visual import code_executor as ce
+from abstractruntime.visualflow_compiler.visual.code_executor import (
+    CodeExecutionError,
+    SANDBOX_DENIED_MODULES,
+    create_code_handler,
+    get_code_execution_policy,
+    sandbox_import_reason,
+    validate_code,
+)
+from abstractruntime.visualflow_compiler.visual.function_library import FunctionLibraryError, compile_function_library
+
+STDLIB_CODE = (
+    "import time\n"
+    "import json\n"
+    "from datetime import datetime\n"
+    "import textwrap\n"
+    "from urllib.parse import quote\n"
+    "from urllib import parse as urlparse\n"
+    "import collections, re\n"
+    "\n"
+    "def transform(_input):\n"
+    "    inside = __import_in_body(_input)\n"
+    "    return {\n"
+    "        'ctime': len(time.ctime()) > 0,\n"
+    "        'json': json.dumps({'a': 1}),\n"
+    "        'year': datetime(2026, 1, 2).year,\n"
+    "        'wrap': textwrap.shorten('a b c d', 7),\n"
+    "        'from_pkg': urlparse.quote('c d'),\n"
+    "        'quote': quote('a b'),\n"
+    "        'counter': dict(collections.Counter('aab')),\n"
+    "        're': re.sub('a', 'b', 'aa'),\n"
+    "        'inside': inside,\n"
+    "    }\n"
+    "\n"
+    "def __import_in_body(x):\n"
+    "    import math\n"
+    "    from statistics import mean\n"
+    "    return math.floor(mean([1, 2, 4]))\n"
+).replace("__import_in_body", "helper")
+
+EXPECTED = {"ctime": True, "json": '{"a": 1}', "year": 2026, "wrap": "a b c d", "from_pkg": "c%20d", "quote": "a%20b", "counter": {"a": 2, "b": 1}, "re": "bb", "inside": 2}
+
+
+@pytest.fixture(params=["restricted", "basic"])
+def lane(request, monkeypatch):
+    """Both sandbox lanes: RestrictedPython, and the fallback used without it."""
+    if request.param == "restricted":
+        pytest.importorskip("RestrictedPython")
+    else:
+        monkeypatch.setattr(ce, "RESTRICTED_PYTHON_AVAILABLE", False)
+    return request.param
+
+
+def test_standard_library_imports_run_in_the_sandbox(lane) -> None:
+    assert create_code_handler(STDLIB_CODE)({"input": None}) == EXPECTED
+
+
+def test_future_annotations_import_is_allowed(lane) -> None:
+    code = "from __future__ import annotations\n\ndef transform(_input: dict) -> int:\n    return len(_input)\n"
+    assert create_code_handler(code)({"a": 1, "b": 2}) == 2
+
+
+def test_the_operator_example_import_time_then_ctime(lane) -> None:
+    code = "import time; os_time = time.ctime()\n\ndef transform(_input):\n    return str(_input) + ' - ' + os_time[:3]\n"
+    out = create_code_handler(code)({"input": None})
+    assert out.startswith("{'input': None} - ") and len(out) == len("{'input': None} - ") + 3
+
+
+@pytest.mark.parametrize(
+    "code, fragment",
+    [
+        ("import os\n", "import of 'os' is not allowed in the sandbox: it reaches processes and the operating system"),
+        ("from os import path\n", "import of 'os' is not allowed in the sandbox"),
+        ("import os.path\n", "import of 'os.path' is not allowed in the sandbox: it reaches processes"),
+        ("import subprocess\n", "it reaches processes and the operating system"),
+        ("import pathlib\n", "it reaches files on the machine"),
+        ("import io\n", "it reaches files on the machine"),
+        ("import socket\n", "it reaches the network"),
+        ("import urllib.request\n", "it reaches the network; only urllib.parse is importable"),
+        ("import urllib\n", "only urllib.parse is importable"),
+        ("from urllib import request\n", "it reaches the network; only urllib.parse is importable"),
+        ("from urllib import parse, request\n", "only urllib.parse is importable"),
+        ("import operator\n", "it reaches around the sandbox's checks (attributes by name, evaluated annotations, frames)"),
+        ("import typing\n", "it reaches around the sandbox's checks"),
+        ("import functools\n", "it reaches around the sandbox's checks"),
+        ("import traceback\n", "it reaches around the sandbox's checks"),
+        ("import xml.etree.ElementTree as ET\n", "import of 'xml.etree.ElementTree' is not allowed in the sandbox: it reaches files on the machine"),
+        ("import configparser\n", "it reaches files on the machine"),
+        ("import argparse\n", "it reaches files on the machine"),
+        ("import importlib\n", "it reaches loading or running code"),
+        ("import sys\n", "it reaches loading or running code"),
+        ("import pickle\n", "it reaches loading or running code"),
+        ("import numpy\n", "import of 'numpy' is not allowed in the sandbox: only Python's own standard library is importable"),
+        ("import _io\n", "import of '_io' is not allowed in the sandbox: a private module"),
+        ("from json import *\n", "'from json import *' is not allowed in the sandbox"),
+        ("from . import x\n", "relative imports are not allowed in the sandbox"),
+    ],
+)
+def test_refused_imports_fail_at_compile_time_with_the_reason(code: str, fragment: str) -> None:
+    with pytest.raises(CodeExecutionError, match=fragment.replace("(", "\\(").replace(")", "\\)").replace("*", "\\*").replace(".", "\\.")):
+        validate_code(code + "\ndef transform(_input):\n    return 1\n")
+    # ...and every refusal names full_access as the way out, except the syntactic ones.
+    if "not allowed in the sandbox:" in fragment:
+        with pytest.raises(CodeExecutionError, match="full_access lifts this limit"):
+            validate_code(code + "\ndef transform(_input):\n    return 1\n")
+
+
+def test_dynamic_import_call_is_refused_with_the_alternative() -> None:
+    with pytest.raises(CodeExecutionError, match="'__import__' is not allowed in the sandbox: write `import <module>` instead"):
+        validate_code("def transform(_input):\n    return __import__('time')\n")
+
+
+def test_the_runtime_guard_applies_the_same_rule(lane) -> None:
+    """The AST check can be sidestepped only by code the sandbox itself runs;
+    the __import__ bound into the sandbox builtins refuses the same names."""
+    assert ce._sandbox_import("json").dumps({"a": 1}) == '{"a": 1}'
+    with pytest.raises(CodeExecutionError, match="import of 'subprocess' is not allowed in the sandbox"):
+        ce._sandbox_import("subprocess")
+    with pytest.raises(CodeExecutionError, match="relative imports are not allowed"):
+        ce._sandbox_import("x", None, None, (), 1)
+    # `from urllib import parse` reaches the guard as the package + a fromlist: allowed for that one.
+    assert ce._sandbox_import("urllib", None, None, ("parse",), 0).parse.quote("a b") == "a%20b"
+    with pytest.raises(CodeExecutionError, match="only urllib.parse is importable"):
+        ce._sandbox_import("urllib", None, None, ("request",), 0)
+    # The handler's builtins carry that guard, not the interpreter's __import__.
+    code = "def transform(_input):\n    import json\n    return json.dumps(_input)\n"
+    assert create_code_handler(code)({"k": 1}) == '{"k": 1}'
+
+
+def test_full_access_imports_anything(monkeypatch) -> None:
+    monkeypatch.setenv("ABSTRACTRUNTIME_CODE_FULL_ACCESS", "1")
+    code = "import os\n\ndef transform(_input):\n    return os.sep\n"
+    assert create_code_handler(code, permissions="full_access")({}) in ("/", "\\")
+    # The sandbox still refuses it under the same host policy.
+    with pytest.raises(CodeExecutionError, match="import of 'os' is not allowed in the sandbox"):
+        create_code_handler(code)
+
+
+def test_import_rule_reasons() -> None:
+    assert sandbox_import_reason("json") is None
+    assert sandbox_import_reason("collections.abc") is None
+    assert sandbox_import_reason("email.utils") is None
+    assert sandbox_import_reason("urllib.parse") is None
+    assert sandbox_import_reason("") == "an empty module name"
+    assert sandbox_import_reason("os") == "it reaches processes and the operating system"
+    assert sandbox_import_reason("tempfile") == "it reaches files on the machine"
+    assert sandbox_import_reason("http.client") == "it reaches the network"
+    assert sandbox_import_reason("types") == "it reaches loading or running code"
+    assert sandbox_import_reason("operator") == "it reaches around the sandbox's checks (attributes by name, evaluated annotations, frames)"
+    assert sandbox_import_reason("sched") is None and sandbox_import_reason("__future__") is None
+    assert sandbox_import_reason("platform") == "it reaches processes and the operating system"
+    assert sandbox_import_reason("mimetypes") == "it reaches files on the machine"
+    assert "sched_h" not in SANDBOX_DENIED_MODULES and "platform_h" not in SANDBOX_DENIED_MODULES
+    assert sandbox_import_reason("requests") == "only Python's own standard library is importable"
+    # Every denied module names a reason, and the list is the standard library's (or a
+    # historical member: modules removed by newer Pythons stay refused for older ones).
+    assert all(SANDBOX_DENIED_MODULES.values())
+
+
+def test_policy_tells_thin_clients_what_the_sandbox_imports() -> None:
+    sandbox = next(m for m in get_code_execution_policy()["modes"] if m["id"] == "sandbox")
+    assert sandbox["imports"]["allowed"] == "python standard library"
+    assert {"os", "subprocess", "operator", "typing", "functools", "traceback", "xml"} <= set(sandbox["imports"]["denied_modules"])
+    assert sandbox["safety"] in ("restricted_python", "basic")
+    assert sandbox["imports"]["allowed_submodules"] == ["urllib.parse"]
+    assert "standard library is importable" in sandbox["description"]
+
+
+def test_function_library_shares_the_rule() -> None:
+    lib = compile_function_library([{"name": "slug", "code": "def slug(s):\n    import re\n    return re.sub('[^a-z]+', '-', s.lower())\n"}])
+    assert lib["slug"]("Hello World") == "hello-world"
+    with pytest.raises(FunctionLibraryError, match="import of 'os' is not allowed in the sandbox"):
+        compile_function_library([{"name": "evil", "code": "def evil():\n    import os\n    return os.getcwd()\n"}])
+
+
+# --- the returned value must be JSON data (operator 2026-10-16 14:37: HTTP 500
+# "Unable to serialize unknown type: <class 'module'>" after `return _input, "...", time`)
+
+def test_returning_a_module_is_a_clear_error_not_a_serializer_crash(lane) -> None:
+    code = "import time; os_time = time.ctime()\n\ndef transform(_input):\n    return _input, ' - deterministic code: ', time\n"
+    with pytest.raises(CodeExecutionError, match=r"transform returned a value that cannot be sent as JSON: module 'time' at output\[2\]\. Return data"):
+        create_code_handler(code)({"input": None})
+    fixed = "import time; os_time = time.ctime()\n\ndef transform(_input):\n    return _input, ' - deterministic code: ', os_time\n"
+    out = create_code_handler(fixed)({"input": None})
+    assert out[0] == {"input": None} and out[1] == " - deterministic code: " and isinstance(out[2], str)
+
+
+def test_json_offender_paths(lane) -> None:
+    code = "def transform(_input):\n    return {'a': [1, {'b': set([1])}]}\n"
+    with pytest.raises(CodeExecutionError, match=r"set at output\['a'\]\[1\]\['b'\]"):
+        create_code_handler(code)({})
+    code = "def transform(_input):\n    return {'ok': [1, 2.5, 'x', None, True], 'nested': {'k': (1, 2)}}\n"
+    assert create_code_handler(code)({}) == {"ok": [1, 2.5, "x", None, True], "nested": {"k": (1, 2)}}
+
+
+def test_full_access_results_must_be_json_too(monkeypatch) -> None:
+    monkeypatch.setenv("ABSTRACTRUNTIME_CODE_FULL_ACCESS", "1")
+    code = "import os\n\ndef transform(_input):\n    return os\n"
+    with pytest.raises(CodeExecutionError, match="cannot be sent as JSON: module 'os' at output"):
+        create_code_handler(code, permissions="full_access")({})

{abstractruntime-0.10.1 → abstractruntime-0.10.2}/tests/test_visualflow_function_library.py

@@ -337,7 +337,7 @@ def test_top_level_import_refused() -> None:
     # A top-level import is refused — validate_code (shared with code nodes)
     # catches imports first; the top-level-defs-only purity rule is a further
     # backstop (see test_purity_refuses_top_level_mutable_container).
-    with pytest.raises(FunctionLibraryError, match="Imports are not allowed"):
+    with pytest.raises(FunctionLibraryError, match="import of 'os' is not allowed in the sandbox"):
         compile_function_library(
             [{"name": "evil", "code": "import os\ndef evil():\n    return os.getcwd()\n"}]
         )
@@ -347,7 +347,7 @@ def test_import_inside_body_refused() -> None:
     # An import INSIDE a function body is structurally legal (a def) but the
     # shared validate_code (same lane as code nodes) refuses imports at BUILD —
     # one sandbox, one rule (the library lane must not be weaker).
-    with pytest.raises(FunctionLibraryError, match="Imports are not allowed"):
+    with pytest.raises(FunctionLibraryError, match="import of 'os' is not allowed in the sandbox"):
         compile_function_library(
             [{"name": "evil", "code": "def evil():\n    import os\n    return os.getcwd()\n"}]
         )