PyVaultRCE 2.3.0__tar.gz → 2.5.0__tar.gz

{pyvaultrce-2.3.0 → pyvaultrce-2.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: PyVaultRCE
-Version: 2.3.0
+Version: 2.5.0
 Summary: Remote Code Execution & Hosting client for PyVault — source never exposed
 Author: PyVault
 Keywords: remote execution code hosting vault rce session
@@ -25,7 +25,7 @@ Dynamic: summary
 
 # PyVaultRCE
 
-Remote Code Execution & Hosting client for **PyVault**.
+Remote Code Hosting client for **PyVault**.
 
 Upload Python scripts to a PyVault server and execute them remotely — the source code **never leaves the server**. Clients only ever hold a 21-character hex Session ID.
 
@@ -47,9 +47,22 @@ sid = CodeManager.enc("my_script.py")
 # Upload from a paste service URL
 sid = CodeManager.enc_url("https://pastebin.com/abcXYZ123")
 
-# Execute remotely (source stays on server)
+# Execute in a short-lived isolated subprocess by default
 CodeManager.run(sid)
 
+# Upload with a short share link and library metadata
+sid = CodeManager.enc(
+    "my_script.py",
+    label="analytics demo",
+    libraries=["requests", "pandas"],
+    username="your_name",
+    description="A public demo post",
+    tags=["python", "demo"],
+)
+
+# Hide PyVault status messages while running
+CodeManager.run(sid, show_terminal=False)
+
 # Check metadata without incrementing execution counter
 CodeManager.info(sid)
 
@@ -62,16 +75,29 @@ CodeManager.ping()
 Set `PYVAULT_URL` to point at your hosted PyVault server:
 
 ```bash
-export PYVAULT_URL=https://your-server.replit.app
+export PYVAULT_URL=https://secure-code-runner--diwasrepl.replit.app
 ```
 
+The package uses the public PyVault deployment when `PYVAULT_URL` is not set.
+For local development, explicitly use `PYVAULT_URL=http://localhost:5000`.
+You can also control status output globally:
+
+```bash
+export PYVAULT_TERMINAL=off
+```
+
+Library names are metadata only. PyVault does not auto-install packages or
+execute dependency installers; install the libraries in the Python environment
+where `CodeManager.run()` executes.
+
 ## API Reference
 
 | Method | Description |
 |--------|-------------|
 | `CodeManager.enc(file_path)` | Upload a local `.py` file → returns Session ID |
+| `CodeManager.enc(file_path, label=..., libraries=[...], username=..., description=..., tags=...)` | Upload with public profile metadata and visible library metadata |
 | `CodeManager.enc_url(url)` | Download code from a paste URL and upload → returns Session ID |
-| `CodeManager.run(session_id)` | Fetch and execute code by Session ID |
+| `CodeManager.run(session_id, show_terminal=False, isolated=True)` | Fetch and execute code in an isolated subprocess with timeout/resource limits |
 | `CodeManager.info(session_id)` | Get session metadata (no exec count increment) |
 | `CodeManager.ping()` | Check server connectivity |
 | `CodeManager.edit(session_id, file_path, admin_token=...)` | Replace stored code (admin or owner token) |
@@ -102,6 +128,11 @@ export PYVAULT_URL=https://your-server.replit.app
 - Session IDs are 21-character cryptographically random hex strings
 - Source code is never written to disk on the client
 - Code is encrypted at rest with Fernet on the server
+- Code runs in a short-lived subprocess by default with a clean environment,
+  temporary working directory, CPU/memory/file-size limits, and a hard timeout
+- `isolated=False` is an explicit trusted-code escape hatch for shared namespaces;
+  it is not recommended for untrusted sessions
+- Share links expose only session metadata and declared library names, never source
 - Admin edits require the admin access code; owner edits/deletes require the one-time owner token
 - Sessions never expire unless an expiry is explicitly selected
 

{pyvaultrce-2.3.0 → pyvaultrce-2.5.0}/PyVaultRCE.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: PyVaultRCE
-Version: 2.3.0
+Version: 2.5.0
 Summary: Remote Code Execution & Hosting client for PyVault — source never exposed
 Author: PyVault
 Keywords: remote execution code hosting vault rce session
@@ -25,7 +25,7 @@ Dynamic: summary
 
 # PyVaultRCE
 
-Remote Code Execution & Hosting client for **PyVault**.
+Remote Code Hosting client for **PyVault**.
 
 Upload Python scripts to a PyVault server and execute them remotely — the source code **never leaves the server**. Clients only ever hold a 21-character hex Session ID.
 
@@ -47,9 +47,22 @@ sid = CodeManager.enc("my_script.py")
 # Upload from a paste service URL
 sid = CodeManager.enc_url("https://pastebin.com/abcXYZ123")
 
-# Execute remotely (source stays on server)
+# Execute in a short-lived isolated subprocess by default
 CodeManager.run(sid)
 
+# Upload with a short share link and library metadata
+sid = CodeManager.enc(
+    "my_script.py",
+    label="analytics demo",
+    libraries=["requests", "pandas"],
+    username="your_name",
+    description="A public demo post",
+    tags=["python", "demo"],
+)
+
+# Hide PyVault status messages while running
+CodeManager.run(sid, show_terminal=False)
+
 # Check metadata without incrementing execution counter
 CodeManager.info(sid)
 
@@ -62,16 +75,29 @@ CodeManager.ping()
 Set `PYVAULT_URL` to point at your hosted PyVault server:
 
 ```bash
-export PYVAULT_URL=https://your-server.replit.app
+export PYVAULT_URL=https://secure-code-runner--diwasrepl.replit.app
 ```
 
+The package uses the public PyVault deployment when `PYVAULT_URL` is not set.
+For local development, explicitly use `PYVAULT_URL=http://localhost:5000`.
+You can also control status output globally:
+
+```bash
+export PYVAULT_TERMINAL=off
+```
+
+Library names are metadata only. PyVault does not auto-install packages or
+execute dependency installers; install the libraries in the Python environment
+where `CodeManager.run()` executes.
+
 ## API Reference
 
 | Method | Description |
 |--------|-------------|
 | `CodeManager.enc(file_path)` | Upload a local `.py` file → returns Session ID |
+| `CodeManager.enc(file_path, label=..., libraries=[...], username=..., description=..., tags=...)` | Upload with public profile metadata and visible library metadata |
 | `CodeManager.enc_url(url)` | Download code from a paste URL and upload → returns Session ID |
-| `CodeManager.run(session_id)` | Fetch and execute code by Session ID |
+| `CodeManager.run(session_id, show_terminal=False, isolated=True)` | Fetch and execute code in an isolated subprocess with timeout/resource limits |
 | `CodeManager.info(session_id)` | Get session metadata (no exec count increment) |
 | `CodeManager.ping()` | Check server connectivity |
 | `CodeManager.edit(session_id, file_path, admin_token=...)` | Replace stored code (admin or owner token) |
@@ -102,6 +128,11 @@ export PYVAULT_URL=https://your-server.replit.app
 - Session IDs are 21-character cryptographically random hex strings
 - Source code is never written to disk on the client
 - Code is encrypted at rest with Fernet on the server
+- Code runs in a short-lived subprocess by default with a clean environment,
+  temporary working directory, CPU/memory/file-size limits, and a hard timeout
+- `isolated=False` is an explicit trusted-code escape hatch for shared namespaces;
+  it is not recommended for untrusted sessions
+- Share links expose only session metadata and declared library names, never source
 - Admin edits require the admin access code; owner edits/deletes require the one-time owner token
 - Sessions never expire unless an expiry is explicitly selected
 

{pyvaultrce-2.3.0 → pyvaultrce-2.5.0}/README.md

@@ -1,6 +1,6 @@
 # PyVaultRCE
 
-Remote Code Execution & Hosting client for **PyVault**.
+Remote Code Hosting client for **PyVault**.
 
 Upload Python scripts to a PyVault server and execute them remotely — the source code **never leaves the server**. Clients only ever hold a 21-character hex Session ID.
 
@@ -22,9 +22,22 @@ sid = CodeManager.enc("my_script.py")
 # Upload from a paste service URL
 sid = CodeManager.enc_url("https://pastebin.com/abcXYZ123")
 
-# Execute remotely (source stays on server)
+# Execute in a short-lived isolated subprocess by default
 CodeManager.run(sid)
 
+# Upload with a short share link and library metadata
+sid = CodeManager.enc(
+    "my_script.py",
+    label="analytics demo",
+    libraries=["requests", "pandas"],
+    username="your_name",
+    description="A public demo post",
+    tags=["python", "demo"],
+)
+
+# Hide PyVault status messages while running
+CodeManager.run(sid, show_terminal=False)
+
 # Check metadata without incrementing execution counter
 CodeManager.info(sid)
 
@@ -37,16 +50,29 @@ CodeManager.ping()
 Set `PYVAULT_URL` to point at your hosted PyVault server:
 
 ```bash
-export PYVAULT_URL=https://your-server.replit.app
+export PYVAULT_URL=https://secure-code-runner--diwasrepl.replit.app
 ```
 
+The package uses the public PyVault deployment when `PYVAULT_URL` is not set.
+For local development, explicitly use `PYVAULT_URL=http://localhost:5000`.
+You can also control status output globally:
+
+```bash
+export PYVAULT_TERMINAL=off
+```
+
+Library names are metadata only. PyVault does not auto-install packages or
+execute dependency installers; install the libraries in the Python environment
+where `CodeManager.run()` executes.
+
 ## API Reference
 
 | Method | Description |
 |--------|-------------|
 | `CodeManager.enc(file_path)` | Upload a local `.py` file → returns Session ID |
+| `CodeManager.enc(file_path, label=..., libraries=[...], username=..., description=..., tags=...)` | Upload with public profile metadata and visible library metadata |
 | `CodeManager.enc_url(url)` | Download code from a paste URL and upload → returns Session ID |
-| `CodeManager.run(session_id)` | Fetch and execute code by Session ID |
+| `CodeManager.run(session_id, show_terminal=False, isolated=True)` | Fetch and execute code in an isolated subprocess with timeout/resource limits |
 | `CodeManager.info(session_id)` | Get session metadata (no exec count increment) |
 | `CodeManager.ping()` | Check server connectivity |
 | `CodeManager.edit(session_id, file_path, admin_token=...)` | Replace stored code (admin or owner token) |
@@ -77,6 +103,11 @@ export PYVAULT_URL=https://your-server.replit.app
 - Session IDs are 21-character cryptographically random hex strings
 - Source code is never written to disk on the client
 - Code is encrypted at rest with Fernet on the server
+- Code runs in a short-lived subprocess by default with a clean environment,
+  temporary working directory, CPU/memory/file-size limits, and a hard timeout
+- `isolated=False` is an explicit trusted-code escape hatch for shared namespaces;
+  it is not recommended for untrusted sessions
+- Share links expose only session metadata and declared library names, never source
 - Admin edits require the admin access code; owner edits/deletes require the one-time owner token
 - Sessions never expire unless an expiry is explicitly selected
 

{pyvaultrce-2.3.0 → pyvaultrce-2.5.0}/codemanager/__init__.py

@@ -21,5 +21,5 @@ Usage:
 from .manager import CodeManager
 
 __all__ = ["CodeManager"]
-__version__ = "1.0.0"
+__version__ = "2.5.0"
 __author__  = "PyVault"

{pyvaultrce-2.3.0 → pyvaultrce-2.5.0}/codemanager/manager.py

@@ -3,7 +3,9 @@ manager.py — CodeManager implementation
 """
 
 import os
+import subprocess
 import sys
+import tempfile
 import traceback
 import textwrap
 from typing import Optional
@@ -15,7 +17,7 @@ except ImportError:
         "The 'requests' library is required. Install it with: pip install requests"
     )
 
-_DEFAULT_BASE_URL = "https://secure-code-runner--diwasreplit.replit.app"
+_DEFAULT_BASE_URL = "https://secure-code-runner--diwasrepl.replit.app"
 
 # ── Validation helpers ───────────────────────────────────────────────────────
 
@@ -40,6 +42,70 @@ def _get_base_url(base_url: Optional[str]) -> str:
     return url
 
 
+def _terminal_enabled(show_terminal=None) -> bool:
+    if show_terminal is not None:
+        return bool(show_terminal)
+    return os.environ.get("PYVAULT_TERMINAL", "on").strip().lower() not in {
+        "0", "false", "off", "no", "quiet"
+    }
+
+
+def _emit(message: str, show_terminal=None, *, error=False) -> None:
+    if _terminal_enabled(show_terminal):
+        print(message, file=sys.stderr if error else sys.stdout, flush=True)
+
+
+def _isolated_run(code: str, session_id: str, timeout: int) -> subprocess.CompletedProcess:
+    """Execute in a short-lived process with clean environment and limits."""
+    def limit_resources():
+        if os.name != "posix":
+            return
+        try:
+            import resource
+            cpu = max(1, min(int(timeout), 30))
+            # Python's runtime reserves virtual address space during startup;
+            # 512 MiB breaks otherwise tiny scripts on some Linux builds.
+            memory = 2 * 1024 * 1024 * 1024
+            resource.setrlimit(resource.RLIMIT_CPU, (cpu, cpu))
+            resource.setrlimit(resource.RLIMIT_AS, (memory, memory))
+            resource.setrlimit(resource.RLIMIT_FSIZE, (10 * 1024 * 1024, 10 * 1024 * 1024))
+        except (ImportError, OSError, ValueError):
+            pass
+
+    clean_env = {
+        key: os.environ[key]
+        for key in ("PATH", "SystemRoot", "SYSTEMROOT", "TEMP", "TMP", "HOME", "LANG", "LC_ALL")
+        if key in os.environ
+    }
+    clean_env.update({"PYTHONNOUSERSITE": "1", "PYTHONUNBUFFERED": "1"})
+    with tempfile.TemporaryDirectory(prefix="pyvault-run-") as workdir:
+        script_path = os.path.join(workdir, "session.py")
+        with open(script_path, "w", encoding="utf-8") as handle:
+            handle.write(code)
+        try:
+            return subprocess.run(
+                [sys.executable, "-I", "-u", script_path],
+                cwd=workdir,
+                env=clean_env,
+                capture_output=True,
+                text=True,
+                timeout=max(1, int(timeout)),
+                check=False,
+                preexec_fn=limit_resources if os.name == "posix" else None,
+            )
+        except subprocess.TimeoutExpired as exc:
+            raise TimeoutError(
+                f"Isolated session '{session_id}' exceeded the {timeout}s execution timeout."
+            ) from exc
+
+
+def _emit_child_output(result: subprocess.CompletedProcess) -> None:
+    if result.stdout:
+        print(result.stdout, end="", flush=True)
+    if result.stderr:
+        print(result.stderr, end="", file=sys.stderr, flush=True)
+
+
 # ── CodeManager ─────────────────────────────────────────────────────────────
 
 class CodeManager:
@@ -59,6 +125,11 @@ class CodeManager:
         file_path: str,
         base_url: Optional[str] = None,
         timeout: int = 30,
+        label: str = "",
+        libraries = "",
+        username: str = "",
+        description: str = "",
+        tags = "",
     ) -> str:
         """
         Read a local Python file and upload it to the PyVault backend.
@@ -98,7 +169,14 @@ class CodeManager:
         try:
             response = requests.post(
                 url,
-                json={"code": code},
+                json={
+                    "code": code,
+                    "label": label,
+                    "libraries": libraries,
+                    "username": username,
+                    "description": description,
+                    "tags": tags,
+                },
                 timeout=timeout,
             )
         except requests.exceptions.ConnectionError:
@@ -142,12 +220,17 @@ class CodeManager:
         base_url: Optional[str] = None,
         timeout: int = 30,
         globals_dict: Optional[dict] = None,
+        show_terminal=None,
+        isolated: bool = True,
     ) -> None:
         """
-        Fetch the code for a Session ID from PyVault and execute it locally.
+        Fetch the code for a Session ID from PyVault and execute it in a
+        short-lived isolated subprocess by default.
 
-        The source code is fetched over the network and run via exec() —
-        the caller never has direct access to the source file on disk.
+        The source code is fetched over the network. The default subprocess
+        uses a clean environment, a temporary working directory, and resource
+        limits. Use isolated=False only for trusted code that needs a shared
+        in-process namespace.
 
         Args:
             session_id:   The 21-character hex Session ID.
@@ -208,30 +291,43 @@ class CodeManager:
                 f"Server returned empty code for session '{session_id}'."
             )
 
-        print(f"[PyVault] Executing session '{session_id}' (run #{exec_count})…")
+        _emit(
+            f"[PyVault] Executing session '{session_id}' "
+            f"(run #{exec_count}, isolated={isolated})…",
+            show_terminal,
+        )
 
-        namespace = globals_dict if globals_dict is not None else {
-            "__name__": "__pyvault__",
-            "__builtins__": __builtins__,
-        }
+        if isolated:
+            if globals_dict is not None:
+                raise ValueError("isolated=True cannot use globals_dict; pass isolated=False for a shared namespace.")
+            result = _isolated_run(code, session_id, timeout)
+            _emit_child_output(result)
+            if result.returncode != 0:
+                raise RuntimeError(
+                    f"Isolated session '{session_id}' exited with code {result.returncode}."
+                )
+        else:
+            namespace = globals_dict if globals_dict is not None else {
+                "__name__": "__pyvault__",
+                "__builtins__": __builtins__,
+            }
+            try:
+                compiled = compile(code, f"<pyvault:{session_id}>", "exec")
+                exec(compiled, namespace)
+            except SyntaxError as exc:
+                _emit("\n[PyVault] ✕ Syntax error in remote code:", show_terminal, error=True)
+                _emit(f"  Line {exc.lineno}: {exc.msg}", show_terminal, error=True)
+                if exc.text:
+                    _emit(f"  >>> {exc.text.strip()}", show_terminal, error=True)
+                raise
+            except Exception:
+                _emit("\n[PyVault] ✕ Runtime error during execution:", show_terminal, error=True)
+                tb_lines = traceback.format_exc().splitlines()
+                for line in tb_lines:
+                    _emit(f"  {line}", show_terminal, error=True)
+                raise
 
-        try:
-            compiled = compile(code, f"<pyvault:{session_id}>", "exec")
-            exec(compiled, namespace)
-        except SyntaxError as exc:
-            print(f"\n[PyVault] ✕ Syntax error in remote code:", file=sys.stderr)
-            print(f"  Line {exc.lineno}: {exc.msg}", file=sys.stderr)
-            if exc.text:
-                print(f"  >>> {exc.text.strip()}", file=sys.stderr)
-            raise
-        except Exception as exc:
-            print(f"\n[PyVault] ✕ Runtime error during execution:", file=sys.stderr)
-            tb_lines = traceback.format_exc().splitlines()
-            for line in tb_lines:
-                print(f"  {line}", file=sys.stderr)
-            raise
-
-        print(f"[PyVault] ✓ Execution complete.")
+        _emit("[PyVault] ✓ Execution complete.", show_terminal)
 
     @staticmethod
     def edit(

{pyvaultrce-2.3.0 → pyvaultrce-2.5.0}/pyvaultrce/__init__.py

@@ -18,5 +18,5 @@ Quick start:
 from .manager import CodeManager
 
 __all__    = ["CodeManager"]
-__version__ = "2.3.0"
+__version__ = "2.5.0"
 __author__  = "PyVault"

{pyvaultrce-2.3.0 → pyvaultrce-2.5.0}/pyvaultrce/manager.py

@@ -4,7 +4,9 @@ manager.py — CodeManager implementation for PyVaultRCE
 
 import os
 import re
+import subprocess
 import sys
+import tempfile
 import traceback
 from typing import Optional
 
@@ -23,7 +25,7 @@ try:
 except ImportError:
     _HAS_CRYPTO = False
 
-_DEFAULT_BASE = "https://secure-code-runner--diwasreplit.replit.app"
+_DEFAULT_BASE = "https://secure-code-runner--diwasrepl.replit.app"
 _MAX_LINES = 10_000
 _SID_LEN   = 21
 _HEX_SET   = frozenset("0123456789abcdef")
@@ -47,6 +49,33 @@ def _base(url: Optional[str]) -> str:
     return (url or os.environ.get("PYVAULT_URL") or _DEFAULT_BASE).rstrip("/")
 
 
+def _terminal_enabled(show_terminal: Optional[bool]) -> bool:
+    if show_terminal is not None:
+        return bool(show_terminal)
+    value = os.environ.get("PYVAULT_TERMINAL", "on").strip().lower()
+    return value not in {"0", "false", "off", "no", "quiet"}
+
+
+def _emit(message: str, show_terminal: Optional[bool] = None, *, error: bool = False) -> None:
+    if _terminal_enabled(show_terminal):
+        print(message, file=sys.stderr if error else sys.stdout, flush=True)
+
+
+def _normalise_libraries(value) -> str:
+    if isinstance(value, (list, tuple)):
+        values = value
+    elif isinstance(value, str):
+        values = re.split(r"[,\n]", value)
+    else:
+        values = []
+    cleaned = []
+    for item in values:
+        name = str(item).strip()
+        if name and re.fullmatch(r"[A-Za-z0-9_.-]{1,80}", name) and name not in cleaned:
+            cleaned.append(name)
+    return ", ".join(cleaned)[:500]
+
+
 def _valid_sid(sid: str) -> bool:
     return isinstance(sid, str) and len(sid) == _SID_LEN and all(c in _HEX_SET for c in sid)
 
@@ -144,14 +173,75 @@ def _localhost_hint(url: str) -> str:
     return ""
 
 
+def _isolated_run(code: str, session_id: str, timeout: int) -> subprocess.CompletedProcess:
+    """Run fetched code in a short-lived process with a clean environment.
+
+    This is a defense-in-depth boundary for the client. It is intentionally
+    not described as a container or a complete OS sandbox: callers who need
+    hostile-code isolation should use a dedicated VM/container policy.
+    """
+    def limit_resources():
+        if os.name != "posix":
+            return
+        try:
+            import resource
+            cpu = max(1, min(int(timeout), 30))
+            # Python's runtime reserves virtual address space during startup;
+            # 512 MiB breaks otherwise tiny scripts on some Linux builds.
+            memory = 2 * 1024 * 1024 * 1024
+            resource.setrlimit(resource.RLIMIT_CPU, (cpu, cpu))
+            resource.setrlimit(resource.RLIMIT_AS, (memory, memory))
+            resource.setrlimit(resource.RLIMIT_FSIZE, (10 * 1024 * 1024, 10 * 1024 * 1024))
+        except (ImportError, OSError, ValueError):
+            pass
+
+    clean_env = {}
+    for key in ("PATH", "SystemRoot", "SYSTEMROOT", "TEMP", "TMP", "HOME", "LANG", "LC_ALL"):
+        if key in os.environ:
+            clean_env[key] = os.environ[key]
+    clean_env.update({"PYTHONNOUSERSITE": "1", "PYTHONUNBUFFERED": "1"})
+
+    with tempfile.TemporaryDirectory(prefix="pyvault-run-") as workdir:
+        script_path = os.path.join(workdir, "session.py")
+        with open(script_path, "w", encoding="utf-8") as handle:
+            handle.write(code)
+        try:
+            return subprocess.run(
+                [sys.executable, "-I", "-u", script_path],
+                cwd=workdir,
+                env=clean_env,
+                capture_output=True,
+                text=True,
+                timeout=max(1, int(timeout)),
+                check=False,
+                preexec_fn=limit_resources if os.name == "posix" else None,
+            )
+        except subprocess.TimeoutExpired as exc:
+            raise TimeoutError(
+                f"Isolated session '{session_id}' exceeded the {timeout}s execution timeout."
+            ) from exc
+
+
+def _emit_child_output(result: subprocess.CompletedProcess) -> None:
+    if result.stdout:
+        print(result.stdout, end="", flush=True)
+    if result.stderr:
+        print(result.stderr, end="", file=sys.stderr, flush=True)
+
+
 def _upload_code(
     code: str,
     base_url: Optional[str],
     timeout: int,
     expires_in_hours: Optional[float] = None,
     max_executions: int = 0,
+    label: str = "",
+    libraries = "",
+    username: str = "",
+    description: str = "",
+    tags = "",
 ) -> tuple:
-    """Internal: push code string to /pyv/save. Returns (session_id, owner_token)."""
+    """Internal: push code string to /pyv/save. Returns session metadata."""
     if not code.strip():
         raise ValueError("Code is empty — nothing to upload.")
     line_count = len(code.splitlines())
@@ -164,6 +254,16 @@ def _upload_code(
         payload["expires_in_hours"] = expires_in_hours
     if max_executions and max_executions > 0:
         payload["max_executions"] = max_executions
+    if label:
+        payload["label"] = str(label)[:200]
+    if libraries:
+        payload["libraries"] = _normalise_libraries(libraries)
+    if username:
+        payload["username"] = str(username)[:24]
+    if description:
+        payload["description"] = str(description)[:1000]
+    if tags:
+        payload["tags"] = tags
 
     url  = _base(base_url) + "/pyv/save"
     resp = _http_post(url, payload, timeout)
@@ -178,7 +278,7 @@ def _upload_code(
     owner_token = data.get("owner_token", "")
     if not _valid_sid(sid):
         raise RuntimeError(f"Server returned unexpected Session ID: '{sid}'")
-    return sid, owner_token
+    return sid, owner_token, data.get("share_url", ""), data.get("libraries", "")
 
 
 # ── CodeManager ───────────────────────────────────────────────────────────────
@@ -197,7 +297,8 @@ class CodeManager:
 
     Environment variables:
         PYVAULT_URL — base URL of the PyVault server
-                      (default: https://secure-code-runner--diwasreplit.replit.app)
+         (default: the PyVault public deployment; set PYVAULT_URL to override)
+        PYVAULT_TERMINAL — on/off terminal status messages (default: on)
     """
 
     @staticmethod
@@ -207,6 +308,12 @@ class CodeManager:
         timeout: int = 30,
         expires_in_hours: Optional[float] = None,
         max_executions: int = 0,
+        label: str = "",
+        libraries = "",
+        username: str = "",
+        description: str = "",
+        tags = "",
+        show_terminal: Optional[bool] = None,
     ) -> str:
         """
         Read a local .py file and upload it to PyVault.
@@ -227,14 +334,21 @@ class CodeManager:
         code = _read_file(file_path)
         if not code.strip():
             raise ValueError(f"The file '{file_path}' is empty — nothing to upload.")
-        sid, owner_token = _upload_code(code, base_url, timeout, expires_in_hours, max_executions)
-        print(f"[PyVault] ✓ Uploaded  — Session ID : {sid}", flush=True)
-        print(f"[PyVault]   Source    : {os.path.abspath(file_path)}", flush=True)
-        print(f"[PyVault]   Lines     : {len(code.splitlines()):,}", flush=True)
+        sid, owner_token, share_url, safe_libraries = _upload_code(
+            code, base_url, timeout, expires_in_hours, max_executions, label, libraries,
+            username, description, tags
+        )
+        _emit(f"[PyVault] ✓ Uploaded  — Session ID : {sid}", show_terminal)
+        _emit(f"[PyVault]   Source    : {os.path.abspath(file_path)}", show_terminal)
+        _emit(f"[PyVault]   Lines     : {len(code.splitlines()):,}", show_terminal)
+        if share_url:
+            _emit(f"[PyVault]   Share link: {share_url}", show_terminal)
+        if safe_libraries:
+            _emit(f"[PyVault]   Libraries: {safe_libraries}", show_terminal)
         if owner_token:
-            print(f"\n[PyVault] ⚠ OWNER TOKEN (save this — shown only once!):", flush=True)
-            print(f"[PyVault]   {owner_token}", flush=True)
-            print(f"[PyVault]   Use this to delete or edit your session later.\n", flush=True)
+            _emit("\n[PyVault] ⚠ OWNER TOKEN (save this — shown only once!):", show_terminal)
+            _emit(f"[PyVault]   {owner_token}", show_terminal)
+            _emit("[PyVault]   Use this to delete or edit your session later.\n", show_terminal)
         return sid
 
     @staticmethod
@@ -242,6 +356,12 @@ class CodeManager:
         paste_url: str,
         base_url: Optional[str] = None,
         timeout: int = 30,
+        label: str = "",
+        libraries = "",
+        username: str = "",
+        description: str = "",
+        tags = "",
+        show_terminal: Optional[bool] = None,
     ) -> str:
         """
         Download Python code from a paste service URL and upload to PyVault.
@@ -265,7 +385,7 @@ class CodeManager:
             resp = requests.get(
                 raw_url,
                 timeout=timeout,
-                headers={"User-Agent": "PyVaultRCE/2.3"},
+                headers={"User-Agent": "PyVaultRCE/2.5"},
             )
             resp.raise_for_status()
         except requests.exceptions.ConnectionError:
@@ -283,14 +403,21 @@ class CodeManager:
         if not code.strip():
             raise ValueError("Downloaded content is empty.")
 
-        sid, owner_token = _upload_code(code, base_url, timeout)
-        print(f"[PyVault] ✓ Uploaded from URL — Session ID : {sid}", flush=True)
-        print(f"[PyVault]   Source : {paste_url}", flush=True)
-        print(f"[PyVault]   Lines  : {len(code.splitlines()):,}", flush=True)
+        sid, owner_token, share_url, safe_libraries = _upload_code(
+            code, base_url, timeout, label=label, libraries=libraries,
+            username=username, description=description, tags=tags
+        )
+        _emit(f"[PyVault] ✓ Uploaded from URL — Session ID : {sid}", show_terminal)
+        _emit(f"[PyVault]   Source : {paste_url}", show_terminal)
+        _emit(f"[PyVault]   Lines  : {len(code.splitlines()):,}", show_terminal)
+        if share_url:
+            _emit(f"[PyVault]   Share link: {share_url}", show_terminal)
+        if safe_libraries:
+            _emit(f"[PyVault]   Libraries: {safe_libraries}", show_terminal)
         if owner_token:
-            print(f"\n[PyVault] ⚠ OWNER TOKEN (save this — shown only once!):", flush=True)
-            print(f"[PyVault]   {owner_token}", flush=True)
-            print(f"[PyVault]   Use this to delete or edit your session later.\n", flush=True)
+            _emit("\n[PyVault] ⚠ OWNER TOKEN (save this — shown only once!):", show_terminal)
+            _emit(f"[PyVault]   {owner_token}", show_terminal)
+            _emit("[PyVault]   Use this to delete or edit your session later.\n", show_terminal)
         return sid
 
     @staticmethod
@@ -299,20 +426,27 @@ class CodeManager:
         base_url: Optional[str] = None,
         timeout: int = 30,
         _ns: Optional[dict] = None,
+        show_terminal: Optional[bool] = None,
+        isolated: bool = True,
     ) -> None:
         """
         Fetch the encrypted code for a Session ID from PyVault, decrypt it,
-        and execute it locally.
+        and execute it in a short-lived isolated subprocess by default.
 
-        The source code is transmitted encrypted, decrypted in-memory, never
-        written to disk, and is not accessible after execution.
+        The source code is transmitted encrypted and decrypted in memory. The
+        default subprocess writes it only to a temporary file for the child
+        process, then removes that directory after execution.
 
         Args:
             session_id: The 21-character hex Session ID.
             base_url:   Override the server URL.
             timeout:    HTTP timeout in seconds.
             _ns:        Optional namespace dict passed to exec(). Leave as None
-                        unless you intentionally want to share a namespace.
+                         unless you intentionally want to share a namespace;
+                         providing it requires isolated=False.
+            isolated:   Use the short-lived subprocess boundary (default True).
+                         Set False only for trusted code that needs an in-process
+                         namespace.
 
         Raises:
             ValueError, ConnectionError, RuntimeError, plus any exception
@@ -363,28 +497,41 @@ class CodeManager:
         if not code.strip():
             raise RuntimeError(f"Decrypted code is empty for session '{session_id}'.")
 
-        print(f"[PyVault] ▶ Running session '{session_id}' (execution #{run_count})…", flush=True)
-
-        namespace = _ns if _ns is not None else {
-            "__name__": "__pyvault__",
-            "__builtins__": __builtins__,
-        }
+        _emit(
+            f"[PyVault] ▶ Running session '{session_id}' "
+            f"(execution #{run_count}, isolated={isolated})…",
+            show_terminal,
+        )
 
-        try:
-            exec(compile(code, f"<vault:{session_id[:8]}…>", "exec"), namespace)
-        except SyntaxError as exc:
-            print(f"\n[PyVault] ✕ Syntax error:", file=sys.stderr, flush=True)
-            print(f"  Line {exc.lineno}: {exc.msg}", file=sys.stderr)
-            if exc.text:
-                print(f"  >>> {exc.text.strip()}", file=sys.stderr)
-            raise
-        except Exception:
-            print(f"\n[PyVault] ✕ Runtime error:", file=sys.stderr, flush=True)
-            for line in traceback.format_exc().splitlines():
-                print(f"  {line}", file=sys.stderr)
-            raise
+        if isolated:
+            if _ns is not None:
+                raise ValueError("isolated=True cannot use _ns; pass isolated=False for a shared namespace.")
+            result = _isolated_run(code, session_id, timeout)
+            _emit_child_output(result)
+            if result.returncode != 0:
+                raise RuntimeError(
+                    f"Isolated session '{session_id}' exited with code {result.returncode}."
+                )
+        else:
+            namespace = _ns if _ns is not None else {
+                "__name__": "__pyvault__",
+                "__builtins__": __builtins__,
+            }
+            try:
+                exec(compile(code, f"<vault:{session_id[:8]}…>", "exec"), namespace)
+            except SyntaxError as exc:
+                _emit("\n[PyVault] ✕ Syntax error:", show_terminal, error=True)
+                _emit(f"  Line {exc.lineno}: {exc.msg}", show_terminal, error=True)
+                if exc.text:
+                    _emit(f"  >>> {exc.text.strip()}", show_terminal, error=True)
+                raise
+            except Exception:
+                _emit("\n[PyVault] ✕ Runtime error:", show_terminal, error=True)
+                for line in traceback.format_exc().splitlines():
+                    _emit(f"  {line}", show_terminal, error=True)
+                raise
 
-        print(f"[PyVault] ✓ Execution complete.", flush=True)
+        _emit("[PyVault] ✓ Execution complete.", show_terminal)
 
     @staticmethod
     def info(
@@ -426,6 +573,19 @@ class CodeManager:
         )
         return data
 
+    @staticmethod
+    def share(
+        session_id: str,
+        base_url: Optional[str] = None,
+        timeout: int = 30,
+    ) -> str:
+        """Return the short public metadata link for a session."""
+        data = CodeManager.info(session_id, base_url=base_url, timeout=timeout)
+        share_url = data.get("share_url", "")
+        if not share_url:
+            raise RuntimeError("This server did not return a share URL.")
+        return share_url
+
     @staticmethod
     def ping(
         base_url: Optional[str] = None,

{pyvaultrce-2.3.0 → pyvaultrce-2.5.0}/setup.py

@@ -5,7 +5,7 @@ with open("README.md", "r", encoding="utf-8") as fh:
 
 setup(
     name="PyVaultRCE",
-    version="2.3.0",
+    version="2.5.0",
     author="PyVault",
     description="Remote Code Execution & Hosting client for PyVault — source never exposed",
     long_description=long_description,