AbstractRuntime 0.10.1__tar.gz → 0.10.3__tar.gz

{abstractruntime-0.10.1 → abstractruntime-0.10.3}/CHANGELOG.md

@@ -5,6 +5,39 @@ All notable changes to AbstractRuntime will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.10.3] - 2026-10-18
+
+### Fixed
+
+- Image and video specs whose provider is an endpoint profile (`endpoint:<id>`) run in process instead of in
+  the one-shot local media subprocess. The subprocess isolates local pipelines and has no host
+  endpoint-profile resolver, so a gateway profile (for example an OpenAI-compatible relay serving
+  `gpt-image-2` selected on the gateway's image route) could not be resolved there; in process,
+  AbstractVision resolves it through the resolver the host attached to the client. Tests:
+  `tests/test_endpoint_profile_media_in_process.py`.
+
+## [0.10.2] - 2026-10-16
+
+### Changed
+
+- **Code nodes can import Python's standard library.** In the `sandbox` permission mode, `import json`, `re`,
+  `datetime`, `math`, `collections`, `itertools`, `statistics`, `textwrap`, `hashlib`, `urllib.parse`… now
+  work, at the top of the code and inside functions, in both the RestrictedPython lane and the fallback lane, and
+  inside the function bodies of flow function libraries. The sandbox still refuses third-party packages, private
+  (`_`-prefixed) modules, and the standard-library modules that reach the machine or go around the sandbox's own
+  checks: processes and the operating system (`os`, `subprocess`, `threading`, `signal`, `ctypes`, `platform`…), files (`io`,
+  `pathlib`, `shutil`, `tempfile`, `glob`, `sqlite3`, `logging`, and the parsers that read a file by path: `xml`,
+  `configparser`, `argparse`…), the network (`socket`, `http`, `urllib.request`, `smtplib`…), code loading or
+  interpreter internals (`sys`, `importlib`, `pickle`, `types`, `inspect`…) and attribute access by name,
+  evaluated annotations or frames (`operator`, `typing`, `functools`, `traceback`). A refusal names the module
+  and the reason; `from x import *`, relative imports and the `__import__` call stay refused.
+- **A Code node's return value must be JSON data.** `transform` returning a module, a function, a set, bytes or
+  any other value JSON cannot carry now fails with a sandbox error naming the value and where it sits
+  (`transform returned a value that cannot be sent as JSON: module 'time' at output[2]`), in every permission
+  mode, instead of a serializer crash later in the gateway's simulate reply or the run's persisted state. `full_access` (host policy) imports anything, as before.
+  The rule is applied twice: at compile time by `validate_code`, and at run time by the `__import__` bound into
+  the sandbox builtins. `get_code_execution_policy()` now lists `imports.denied_modules` for thin clients.
+
 ## [0.10.1] - 2026-10-16
 
 ### Changed

{abstractruntime-0.10.1 → abstractruntime-0.10.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: AbstractRuntime
-Version: 0.10.1
+Version: 0.10.3
 Summary: AbstractRuntime: a durable graph runner designed to pair with AbstractCore.
 Project-URL: AbstractCore (website), https://www.abstractcore.ai/
 Project-URL: AbstractRuntime (GitHub), https://github.com/lpalbou/abstractruntime

{abstractruntime-0.10.1 → abstractruntime-0.10.3}/docs/api.md

@@ -355,6 +355,7 @@ Multimodal support:
 - with the pooled local client (`MultiLocalAbstractCoreLLMClient`), a request whose outputs are all non-text (image, video, voice, music, transcription) and that carries no tools never builds the text client: it runs on AbstractCore's capability host (`CapabilityHostProvider`, no text model), and so does streaming TTS. A text default that cannot be built (an engine not installed) therefore never blocks speech or image generation
 - media-only normalized results expose `runtime_provider` / `runtime_model` separately from `media_provider` / `media_model`
 - local image/video generation runs in a one-shot subprocess (`execution_mode="local_one_shot_subprocess"`) unless every requested media model is resident (explicitly loaded with `load_model_residency`), in which case it runs in-process on the loaded pipeline (`execution_mode="resident_in_process"`, `resident_load_ids`)
+- a media spec whose `provider` is an endpoint profile (`endpoint:<id>`) never uses the one-shot subprocess: it is an HTTP call to that endpoint, and the host's endpoint-profile resolver (`set_provider_endpoint_profile_resolver`) exists only in this process
 - optional local media residency failures complete with `status_hint="warning"` and `degraded=true`; local media warmup that no capability plugin can serve (`image_generation`, `image_upscale`, `video_generation`, `text_to_video`, `image_to_video`, `tts`, `stt`, `music_generation`) reports `requires_long_lived_server=true`, and image/video tasks also report `execution_mode="local_one_shot_subprocess"`
 - Gateway/hosts remain responsible for explicit Core server URLs, Core server auth headers, provider/model defaults, selected local-inference profiles, and translation of Gateway-owned env/config into explicit Runtime inputs; Runtime persists only JSON-safe routing metadata and artifact refs
 

{abstractruntime-0.10.1 → abstractruntime-0.10.3}/llms-full.txt

@@ -1225,6 +1225,7 @@ Multimodal support:
 - with the pooled local client (`MultiLocalAbstractCoreLLMClient`), a request whose outputs are all non-text (image, video, voice, music, transcription) and that carries no tools never builds the text client: it runs on AbstractCore's capability host (`CapabilityHostProvider`, no text model), and so does streaming TTS. A text default that cannot be built (an engine not installed) therefore never blocks speech or image generation
 - media-only normalized results expose `runtime_provider` / `runtime_model` separately from `media_provider` / `media_model`
 - local image/video generation runs in a one-shot subprocess (`execution_mode="local_one_shot_subprocess"`) unless every requested media model is resident (explicitly loaded with `load_model_residency`), in which case it runs in-process on the loaded pipeline (`execution_mode="resident_in_process"`, `resident_load_ids`)
+- a media spec whose `provider` is an endpoint profile (`endpoint:<id>`) never uses the one-shot subprocess: it is an HTTP call to that endpoint, and the host's endpoint-profile resolver (`set_provider_endpoint_profile_resolver`) exists only in this process
 - optional local media residency failures complete with `status_hint="warning"` and `degraded=true`; local media warmup that no capability plugin can serve (`image_generation`, `image_upscale`, `video_generation`, `text_to_video`, `image_to_video`, `tts`, `stt`, `music_generation`) reports `requires_long_lived_server=true`, and image/video tasks also report `execution_mode="local_one_shot_subprocess"`
 - Gateway/hosts remain responsible for explicit Core server URLs, Core server auth headers, provider/model defaults, selected local-inference profiles, and translation of Gateway-owned env/config into explicit Runtime inputs; Runtime persists only JSON-safe routing metadata and artifact refs
 

{abstractruntime-0.10.1 → abstractruntime-0.10.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "AbstractRuntime"
-version = "0.10.1"
+version = "0.10.3"
 description = "AbstractRuntime: a durable graph runner designed to pair with AbstractCore."
 readme = "README.md"
 requires-python = ">=3.10"

abstractruntime-0.10.3/release-notes.md

@@ -0,0 +1,8 @@
+### Fixed
+
+- Image and video specs whose provider is an endpoint profile (`endpoint:<id>`) run in process instead of in
+  the one-shot local media subprocess. The subprocess isolates local pipelines and has no host
+  endpoint-profile resolver, so a gateway profile (for example an OpenAI-compatible relay serving
+  `gpt-image-2` selected on the gateway's image route) could not be resolved there; in process,
+  AbstractVision resolves it through the resolver the host attached to the client. Tests:
+  `tests/test_endpoint_profile_media_in_process.py`.

{abstractruntime-0.10.1 → abstractruntime-0.10.3}/src/abstractruntime/integrations/abstractcore/llm_client.py

@@ -2141,6 +2141,20 @@ def _decode_subprocess_media_payload(payload: Dict[str, Any]) -> Dict[str, Any]:
     return out
 
 
+def _spec_routes_to_endpoint_profile(spec: Any) -> bool:
+    """True when a media spec names an `endpoint:<id>` provider.
+
+    Such a spec is an HTTP call to a named endpoint connection, not a local
+    pipeline: the one-shot media subprocess has nothing to isolate for it, and
+    it cannot resolve the profile -- the host's endpoint-profile resolver
+    (`set_provider_endpoint_profile_resolver`) lives on THIS process's
+    clients, and a per-user gateway profile has no AbstractCore config row
+    the subprocess could read. So it runs in process, where AbstractVision
+    resolves the profile through the owning provider's resolver.
+    """
+    return isinstance(spec, dict) and str(spec.get("provider") or "").strip().lower().startswith("endpoint:")
+
+
 def _is_subprocess_safe_image_specs(specs: List[Dict[str, Any]], media: Optional[List[Any]]) -> bool:
     if not _env_flag_enabled("ABSTRACTRUNTIME_LOCAL_IMAGE_SUBPROCESS", default=True):
         return False
@@ -2148,7 +2162,7 @@ def _is_subprocess_safe_image_specs(specs: List[Dict[str, Any]], media: Optional
         return False
     normalized_media = list(media or [])
     for spec in specs:
-        if not isinstance(spec, dict):
+        if not isinstance(spec, dict) or _spec_routes_to_endpoint_profile(spec):
             return False
         modality = str(spec.get("modality") or "").strip().lower()
         task = str(spec.get("task") or "").strip().lower()
@@ -2202,6 +2216,8 @@ def _is_subprocess_safe_video_specs(specs: List[Dict[str, Any]], media: Optional
     if len(specs) != 1 or not isinstance(specs[0], dict):
         return False
     spec = specs[0]
+    if _spec_routes_to_endpoint_profile(spec):
+        return False
     modality = str(spec.get("modality") or "").strip().lower()
     task = str(spec.get("task") or "").strip().lower()
     if modality != "video":

{abstractruntime-0.10.1 → abstractruntime-0.10.3}/src/abstractruntime/visualflow_compiler/visual/code_executor.py

@@ -8,8 +8,10 @@ without importing the web backend implementation.
 from __future__ import annotations
 
 import ast
+import builtins as _builtins
 import os
-from typing import Any, Callable, Dict
+import sys
+from typing import Any, Callable, Dict, Optional
 
 # Try to import RestrictedPython, fall back to basic execution if not available
 try:
@@ -83,6 +85,173 @@ if RESTRICTED_PYTHON_AVAILABLE:
             super().check_name(node, name, allow_magic_methods)
 
 
+# ---------------------------------------------------------------------------
+# Imports in the sandbox: Python's own standard library, except the modules
+# that reach outside the interpreter. One rule for the AST check at compile
+# time (validate_code) and the ``__import__`` guard at run time (the guard is
+# what actually gates: the AST check only makes the refusal early and clear).
+# ---------------------------------------------------------------------------
+
+# Top-level standard-library modules the sandbox refuses, each with the reason
+# shown to the author. Grouped by what the module reaches.
+SANDBOX_DENIED_MODULES: Dict[str, str] = {
+    # processes, the OS, the interpreter
+    **{m: "processes and the operating system" for m in (
+        "os", "posix", "nt", "posixpath", "ntpath", "genericpath", "subprocess", "multiprocessing",
+        "threading", "_thread", "concurrent", "asyncio", "signal", "ctypes", "resource", "pwd", "grp",
+        "pty", "tty", "termios", "fcntl", "pipes", "crypt", "spwd", "nis", "syslog", "mmap", "msvcrt",
+        "winreg", "winsound", "ossaudiodev", "locale", "getpass", "readline", "rlcompleter", "cmd",
+        "atexit", "faulthandler", "gc", "webbrowser", "antigravity", "this", "turtle", "turtledemo",
+        "tkinter", "curses", "idlelib",
+        # runs uname/sw_vers and reads /etc/os-release to answer
+        "platform",
+    )},
+    # files on the machine
+    **{m: "files on the machine" for m in (
+        "io", "pathlib", "shutil", "tempfile", "glob", "fileinput", "linecache", "filecmp", "zipfile",
+        "tarfile", "gzip", "bz2", "lzma", "dbm", "shelve", "sqlite3", "codecs", "logging", "wave", "aifc",
+        "sunau", "chunk", "sndhdr", "imghdr", "tokenize", "mailbox", "mailcap", "netrc", "uu", "cgi",
+        "cgitb", "pyclbr", "tabnanny",
+        # parsers and readers that take a file PATH (xml.*.parse, configparser.read,
+        # argparse's @argument-files, gettext's catalogs)
+        "xml", "pyexpat", "configparser", "argparse", "optparse", "gettext",
+        # read_mime_types(path) / MimeTypes.read(path)
+        "mimetypes",
+    )},
+    # the network
+    **{m: "the network" for m in (
+        "socket", "ssl", "select", "selectors", "socketserver", "http", "ftplib", "poplib", "imaplib",
+        "smtplib", "smtpd", "nntplib", "telnetlib", "xmlrpc", "wsgiref", "asynchat", "asyncore",
+    )},
+    # loading or running code, interpreter internals
+    **{m: "loading or running code" for m in (
+        "sys", "builtins", "importlib", "pkgutil", "runpy", "zipimport", "modulefinder", "code", "codeop",
+        "compileall", "py_compile", "marshal", "pickle", "pickletools", "copyreg", "types", "inspect",
+        "dis", "site", "sysconfig", "timeit", "doctest", "unittest", "pdb", "bdb", "trace", "profile",
+        "cProfile", "pstats", "tracemalloc", "test", "lib2to3", "pydoc", "pydoc_data", "ensurepip", "venv",
+        "zipapp", "distutils", "msilib", "__main__", "opcode", "symtable",
+    )},
+    # around the sandbox's own checks: attribute access by NAME (which the dunder
+    # rule cannot see), evaluation of annotation strings, access to frames
+    **{m: "around the sandbox's checks (attributes by name, evaluated annotations, frames)" for m in (
+        "operator", "typing", "functools", "traceback",
+    )},
+}
+
+# A refused package whose one pure submodule is allowed: ``urllib.parse``
+# (URL parsing) is fine, ``urllib.request`` is the network.
+SANDBOX_ALLOWED_SUBMODULES: frozenset = frozenset({"urllib.parse"})
+
+_STDLIB_MODULE_NAMES: frozenset = frozenset(getattr(sys, "stdlib_module_names", ()))
+
+
+def sandbox_import_reason(name: str) -> Optional[str]:
+    """Why the sandbox refuses importing ``name`` — or None when it is allowed.
+
+    Allowed: a module of Python's own standard library whose top-level package
+    is not in SANDBOX_DENIED_MODULES (plus the listed pure submodules of a
+    refused package). Refused: everything else — third-party packages, private
+    (``_``-prefixed) modules, and the standard-library modules that reach
+    processes, files, the network or code loading. ``full_access`` (host
+    policy) lifts every limit.
+    """
+    dotted = str(name or "").strip()
+    if not dotted:
+        return "an empty module name"
+    if dotted in SANDBOX_ALLOWED_SUBMODULES:
+        return None
+    top = dotted.split(".", 1)[0]
+    if top == "__future__":
+        return None
+    if top.startswith("_"):
+        return "a private module"
+    reason = SANDBOX_DENIED_MODULES.get(top)
+    if reason is not None:
+        return f"it reaches {reason}"
+    if top == "urllib":
+        return "it reaches the network; only urllib.parse is importable"
+    if top not in _STDLIB_MODULE_NAMES:
+        return "only Python's own standard library is importable"
+    return None
+
+
+def sandbox_import_check(name: str, fromlist: Any = ()) -> None:
+    """Raise CodeExecutionError when the sandbox refuses importing ``name``.
+
+    ``fromlist`` are the names of a ``from name import a, b`` statement: a
+    refused package is still fine when every one of them is an allowed
+    submodule (``from urllib import parse``).
+    """
+    reason = sandbox_import_reason(name)
+    if reason is not None and fromlist and all(
+        isinstance(item, str) and f"{name}.{item}" in SANDBOX_ALLOWED_SUBMODULES for item in fromlist
+    ):
+        reason = None
+    if reason is not None:
+        raise CodeExecutionError(
+            f"import of '{name}' is not allowed in the sandbox: {reason} "
+            "(full_access lifts this limit)"
+        )
+
+
+def _sandbox_import(name: str, globals: Any = None, locals: Any = None, fromlist: Any = (), level: int = 0) -> Any:
+    """The sandbox's ``__import__``: the same rule as validate_code, applied
+    to the name that is actually imported at run time (relative imports are
+    refused: there is no package for them to be relative to)."""
+    if level:
+        raise CodeExecutionError("relative imports are not allowed in the sandbox")
+    sandbox_import_check(name, tuple(fromlist or ()))
+    return _builtins.__import__(name, globals, locals, fromlist or (), 0)
+
+
+def sandbox_builtins(base: Any) -> Dict[str, Any]:
+    """A copy of ``base`` builtins with the sandbox's ``__import__`` bound."""
+    out: Dict[str, Any] = dict(base)
+    out["__import__"] = _sandbox_import
+    return out
+
+
+def _json_offender(value: Any, path: str = "output") -> Optional[tuple]:
+    """The first value inside ``value`` that JSON cannot carry, as (path, type name)."""
+    if value is None or isinstance(value, (bool, int, float, str)):
+        return None
+    if isinstance(value, (list, tuple)):
+        for i, item in enumerate(value):
+            found = _json_offender(item, f"{path}[{i}]")
+            if found:
+                return found
+        return None
+    if isinstance(value, dict):
+        for key, item in value.items():
+            if not isinstance(key, (str, int, float, bool)) and key is not None:
+                return (f"{path} (key {key!r})", type(key).__name__)
+            found = _json_offender(item, f"{path}[{key!r}]")
+            if found:
+                return found
+        return None
+    name = type(value).__name__
+    if name == "module":
+        name = f"module '{getattr(value, '__name__', '?')}'"
+    elif name in ("function", "builtin_function_or_method", "method"):
+        name = f"function '{getattr(value, '__name__', '?')}'"
+    return (path, name)
+
+
+def ensure_json_result(value: Any, function_name: str = "transform") -> Any:
+    """Return ``value`` when JSON can carry it; otherwise raise a CodeExecutionError
+    that names the offending value and where it sits, so the author sees
+    "return os_time, not the module" instead of a serializer crash later
+    (the gateway's simulate reply, or the run's persisted state)."""
+    found = _json_offender(value)
+    if found is None:
+        return value
+    path, name = found
+    raise CodeExecutionError(
+        f"{function_name} returned a value that cannot be sent as JSON: {name} at {path}. "
+        "Return data: str, int, float, bool, None, lists and dicts of those."
+    )
+
+
 def normalize_code_permissions(permissions: Any = "sandbox") -> str:
     """Return the canonical Code node execution permission mode."""
     raw = str(permissions or "sandbox").strip().lower().replace("-", "_")
@@ -129,8 +298,17 @@ def get_code_execution_policy() -> Dict[str, Any]:
                 "label": "Sandbox",
                 "available": True,
                 "default": True,
-                "safety": "restricted_python",
-                "description": "Protected Python execution with imports and unsafe constructs disabled.",
+                "safety": "restricted_python" if RESTRICTED_PYTHON_AVAILABLE else "basic",
+                "description": (
+                    "Protected Python execution: Python's standard library is importable, except the "
+                    "modules that reach processes, files, the network or code loading; exec/eval, "
+                    "dunder access and third-party packages are refused."
+                ),
+                "imports": {
+                    "allowed": "python standard library",
+                    "denied_modules": sorted(SANDBOX_DENIED_MODULES),
+                    "allowed_submodules": sorted(SANDBOX_ALLOWED_SUBMODULES),
+                },
             },
             {
                 "id": "full_access",
@@ -163,13 +341,24 @@ def validate_code(code: str) -> None:
         raise CodeExecutionError(f"Syntax error: {e}") from e
 
     for node in ast.walk(tree):
-        # Disallow imports
-        if isinstance(node, (ast.Import, ast.ImportFrom)):
-            raise CodeExecutionError("Imports are not allowed")
-
-        # Disallow exec/eval
+        # Imports: Python's own standard library, minus the modules that reach
+        # the machine (sandbox_import_check); the run-time __import__ guard
+        # applies the same rule to whatever is actually imported.
+        if isinstance(node, ast.Import):
+            for alias in node.names:
+                sandbox_import_check(alias.name)
+        elif isinstance(node, ast.ImportFrom):
+            if node.level:
+                raise CodeExecutionError("relative imports are not allowed in the sandbox")
+            if any(alias.name == "*" for alias in node.names):
+                raise CodeExecutionError(f"'from {node.module} import *' is not allowed in the sandbox")
+            sandbox_import_check(node.module or "", tuple(alias.name for alias in node.names))
+
+        # Disallow exec/eval/compile and the dynamic import call (write `import x`)
         if isinstance(node, ast.Call) and isinstance(node.func, ast.Name):
-            if node.func.id in ("exec", "eval", "compile", "__import__"):
+            if node.func.id == "__import__":
+                raise CodeExecutionError("'__import__' is not allowed in the sandbox: write `import <module>` instead")
+            if node.func.id in ("exec", "eval", "compile"):
                 raise CodeExecutionError(f"'{node.func.id}' is not allowed")
 
         # Disallow dunder attributes
@@ -214,9 +403,10 @@ def _create_full_access_handler(code: str, function_name: str) -> Callable[[Any]
             raise CodeExecutionError(f"'{function_name}' is not a callable function")
 
         try:
-            return func(input_data)
+            result = func(input_data)
         except Exception as e:
             raise CodeExecutionError(f"Runtime error: {e}") from e
+        return ensure_json_result(result, function_name)
 
     return handler
 
@@ -259,10 +449,11 @@ def _apply(func: Any, *args: Any, **kwargs: Any) -> Any:
 def _sandbox_parse_json(text: Any) -> Any:
     """``parse_json(text)`` — the sandbox's JSON reader.
 
-    The sandbox has no imports, so JSON parsing was impossible in code nodes
-    and would have been impossible in pin expressions (the design verdict's
-    amendment 4: "parser" helpers were unbuildable inline). Errors stay in
-    the CodeExecutionError family so they surface loudly with attribution.
+    Pin expressions have no imports, and code nodes had none when this helper
+    was added (the design verdict's amendment 4: "parser" helpers were
+    unbuildable inline); it stays the one-call JSON reader of both sandboxes.
+    Errors stay in the CodeExecutionError family so they surface loudly with
+    attribution.
     """
     import json
 
@@ -433,7 +624,7 @@ def _create_restricted_handler(code: str, function_name: str) -> Callable[[Any],
 
     def handler(input_data: Any) -> Any:
         restricted_globals = {
-            "__builtins__": safe_builtins,
+            "__builtins__": sandbox_builtins(safe_builtins),
             "_getiter_": default_guarded_getiter,
             "_getitem_": default_guarded_getitem,
             "_iter_unpack_sequence_": guarded_iter_unpack_sequence,
@@ -473,9 +664,10 @@ def _create_restricted_handler(code: str, function_name: str) -> Callable[[Any],
             raise CodeExecutionError(f"'{function_name}' is not a callable function")
 
         try:
-            return func(input_data)
+            result = func(input_data)
         except Exception as e:
             raise CodeExecutionError(f"Runtime error: {e}") from e
+        return ensure_json_result(result, function_name)
 
     return handler
 
@@ -494,11 +686,13 @@ def _create_basic_handler(code: str, function_name: str) -> Callable[[Any], Any]
         limited_globals = {
             "__builtins__": {
                 # Same convenience set as the restricted lane (one source),
-                # plus the literal names bare exec needs.
+                # plus the literal names bare exec needs and the sandbox's
+                # __import__ (standard library only, see sandbox_import_check).
                 **sandbox_helper_globals(),
                 "True": True,
                 "False": False,
                 "None": None,
+                "__import__": _sandbox_import,
             }
         }
 
@@ -528,8 +722,9 @@ def _create_basic_handler(code: str, function_name: str) -> Callable[[Any], Any]
             raise CodeExecutionError(f"'{function_name}' is not a callable function")
 
         try:
-            return func(input_data)
+            result = func(input_data)
         except Exception as e:
             raise CodeExecutionError(f"Runtime error: {e}") from e
+        return ensure_json_result(result, function_name)
 
     return handler

{abstractruntime-0.10.1 → abstractruntime-0.10.3}/src/abstractruntime/visualflow_compiler/visual/function_library.py

@@ -70,6 +70,7 @@ from .code_executor import (
     CodeExecutionError,
     _apply,
     _inplacevar,
+    sandbox_builtins,
     sandbox_helper_globals,
     validate_code,
 )
@@ -152,11 +153,12 @@ def _validate_library_purity(name: str, code: str) -> None:
     construction, so the process-lifetime shared namespace can never leak
     state across runs/tenants. Build-time, loud, attributed by function name.
 
-    FIRST runs the SAME ``validate_code`` the code-node lane uses (imports,
-    exec/eval/compile/__import__, dunder-attribute access) — one source, no
-    drift ("one sandbox, one rule"). The library lane previously skipped it
-    and let in-body imports fail only at CALL time; now it refuses at build
-    exactly like a code node. The purity rules below are the tier-2 ADDITION
+    FIRST runs the SAME ``validate_code`` the code-node lane uses (imports
+    outside Python's standard library or of the modules that reach the
+    machine, exec/eval/compile/__import__, dunder-attribute access) — one
+    source, no drift ("one sandbox, one rule"). The library lane previously
+    skipped it and let in-body imports fail only at CALL time; now it refuses
+    at build exactly like a code node. The purity rules below are the tier-2 ADDITION
     on top of that shared baseline.
     """
     try:
@@ -232,7 +234,7 @@ def compile_function_library(
     # mirrors the code-node sandbox EXACTLY (one sandbox, one rule) or bodies
     # die at call time with bare sandbox-internal NameErrors.
     shared_ns: Dict[str, Any] = {
-        "__builtins__": safe_builtins,
+        "__builtins__": sandbox_builtins(safe_builtins),  # + the sandbox __import__ (standard library)
         "_getiter_": default_guarded_getiter,
         "_getitem_": default_guarded_getitem,
         "_iter_unpack_sequence_": guarded_iter_unpack_sequence,