agentbox-sandbox 0.4.0__tar.gz

agentbox_sandbox-0.4.0/.env.example

@@ -0,0 +1,5 @@
+AGENTBOX_HOST=0.0.0.0
+AGENTBOX_PORT=8080
+AGENTBOX_LOG_LEVEL=INFO
+AGENTBOX_DEFAULT_TIMEOUT_SECONDS=30
+AGENTBOX_SANDBOX_BACKEND=subprocess

agentbox_sandbox-0.4.0/.github/workflows/ci.yml

@@ -0,0 +1,11 @@
+name: CI
+on: [push, pull_request]
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with: {python-version: "3.12"}
+      - run: pip install -e ".[dev]"
+      - run: pytest tests/ -v

agentbox_sandbox-0.4.0/.gitignore

@@ -0,0 +1,4 @@
+__pycache__/
+.venv/
+.pytest_cache/
+dist/

agentbox_sandbox-0.4.0/CHANGELOG.md

@@ -0,0 +1,30 @@
+# Changelog
+
+## [0.4.0] - 2026-09-14
+
+### Added
+- `limits.memory_mb` on `POST /v1/run` — applies `RLIMIT_AS` in the child process (16–8192 MB)
+- Optional `AGENTBOX_DEFAULT_MEMORY_MB` and SDK `memory_mb=` passthrough
+
+## [0.3.0] - 2026-08-19
+
+### Added
+- Workspace snapshot/restore (`snapshot: true` / `snapshot_id`) so agents can keep files across runs
+
+## [0.2.0] - 2026-08-19
+
+### Added
+- JavaScript/Node runtime (`language: javascript|node`)
+- Per-request `limits.timeout_seconds` (408 on timeout)
+- TypeScript client at `sdk/ts/client.ts`
+- Credential stripping when backend is not `unrestricted`
+
+### Notes
+- Isolation is still subprocess, not gVisor
+
+## [0.1.0] - 2026-08-18
+
+### Added
+- FastAPI service with /health and /v1/run
+- Subprocess sandbox backend (MVP)
+- Python SDK client skeleton

agentbox_sandbox-0.4.0/CONTRIBUTING.md

@@ -0,0 +1,30 @@
+# Contributing
+
+## Running tests
+
+Prefer Docker Compose:
+
+```bash
+docker compose run --rm test
+docker compose up agentbox   # API on :8080 for manual checks
+```
+
+Locally:
+
+```bash
+pip install -e ".[dev]"
+pytest tests/ -v
+agentbox serve
+curl http://localhost:8080/health
+```
+
+## Pull requests
+
+- Treat sandbox changes as security-sensitive; document limitations honestly
+- Update README/CHANGELOG for API or limit changes
+- Prefer small PRs with a clear test plan
+
+## Commit style
+
+- Imperative subject line; mention the user-facing why when relevant
+- Do not add AI co-author trailers (e.g. Co-authored-by: Cursor) to commits.

agentbox_sandbox-0.4.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 agentbox contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

agentbox_sandbox-0.4.0/PKG-INFO

@@ -0,0 +1,171 @@
+Metadata-Version: 2.5
+Name: agentbox-sandbox
+Version: 0.4.0
+Summary: Self-hosted code execution sandbox for AI agents
+Project-URL: Homepage, https://github.com/yashshah9/agentbox
+Project-URL: Repository, https://github.com/yashshah9/agentbox
+Project-URL: Issues, https://github.com/yashshah9/agentbox/issues
+Author-email: Yash Shah <yash376351@gmail.com>
+License-Expression: MIT
+License-File: LICENSE
+Requires-Python: >=3.11
+Requires-Dist: fastapi>=0.111
+Requires-Dist: pydantic-settings>=2.2
+Requires-Dist: pydantic>=2.6
+Requires-Dist: structlog>=24.1
+Requires-Dist: uvicorn[standard]>=0.29
+Provides-Extra: dev
+Requires-Dist: httpx>=0.27; extra == 'dev'
+Requires-Dist: mypy>=1.9; extra == 'dev'
+Requires-Dist: pytest>=8.0; extra == 'dev'
+Requires-Dist: ruff>=0.4; extra == 'dev'
+Description-Content-Type: text/markdown
+
+# agentbox
+
+Self-hosted **code execution sandbox** for AI agents — one `docker compose up` gives you an HTTP API for running untrusted code in isolated environments.
+
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
+[![Python 3.11+](https://img.shields.io/badge/python-3.11+-blue.svg)](https://www.python.org/downloads/)
+[![CI](https://github.com/yashshah9/agentbox/actions/workflows/ci.yml/badge.svg)](https://github.com/yashshah9/agentbox/actions/workflows/ci.yml)
+
+> **Status:** v0.4 — Python + Node subprocess sandbox, timeouts, `limits.memory_mb` via `RLIMIT_AS`, TypeScript client, workspace snapshots.
+
+## 60-second try
+
+```bash
+docker compose up agentbox        # API on :8080
+# in another shell:
+curl -s http://localhost:8080/health
+curl -s -X POST http://localhost:8080/v1/run \
+  -H 'Content-Type: application/json' \
+  -d '{"code":"print(sum(range(10)))"}'
+docker compose run --rm test      # pytest
+```
+
+## Why this vs alternatives
+
+| Approach | Strength | Gap |
+|----------|----------|-----|
+| **agentbox** | Self-hosted HTTP API + SDK, one compose file | Subprocess isolation today, not gVisor |
+| Hosted sandboxes (E2B, etc.) | Strong isolation, managed | Per-second cost; data leaves your network |
+| Raw `docker exec` | Familiar | No agent-oriented API / snapshots / limits |
+| YOLO in the agent process | Zero infra | Full host compromise risk |
+
+## Problem
+
+Every agent that writes and runs code needs a safe execution environment. Teams either YOLO in shared containers or pay per-second for hosted sandboxes. Self-hosting gVisor/Firecracker is weeks of work.
+
+## Key features (v0.4)
+
+- HTTP API: `POST /v1/run` executes Python or JavaScript
+- Per-request `limits.timeout_seconds` (HTTP 408 on timeout)
+- Per-request `limits.memory_mb` (sets `RLIMIT_AS` in the child process; 16–8192)
+- Workspace snapshots: `"snapshot": true` then `"snapshot_id"`
+- Python SDK + TypeScript client (`sdk/ts/client.ts`)
+- Docker image includes Node.js for the JS runtime
+- Credential stripping when the backend is not `unrestricted`
+
+## Architecture
+
+```
+Agent / SDK
+    └── POST /v1/run
+            └── SubprocessSandbox (MVP)
+                    └── (next) gVisor / Docker backend
+```
+
+| Component | Technology | Why |
+|-----------|------------|-----|
+| API | FastAPI | Async-ready, OpenAPI docs, widely adopted |
+| Server | uvicorn | Standard ASGI server |
+| Config | pydantic-settings | Typed env config |
+| Tests | pytest + httpx TestClient | Fast API testing |
+
+## Installation
+
+```bash
+pip install agentbox-sandbox
+pip install -e ".[dev]"
+```
+
+## Usage
+
+### Start server
+
+```bash
+agentbox serve
+# or
+docker compose up agentbox
+```
+
+### Run code
+
+```bash
+curl -X POST http://localhost:8080/v1/run \
+  -H 'Content-Type: application/json' \
+  -d '{"code": "print(sum(range(10)))"}'
+
+curl -X POST http://localhost:8080/v1/run \
+  -H 'Content-Type: application/json' \
+  -d '{"code": "x = bytearray(10**9)", "limits": {"memory_mb": 64, "timeout_seconds": 5}}'
+```
+
+### Python SDK
+
+```python
+from agentbox.sdk.client import AgentboxClient
+
+client = AgentboxClient("http://localhost:8080")
+print(client.health())
+print(client.run("print('hello')"))
+print(client.run("console.log('hello')", language="javascript", timeout_seconds=5))
+print(client.run("x = bytearray(10**8)", memory_mb=64))
+snap = client.run("open('memo.txt','w').write('kept')", snapshot=True)
+print(client.run("print(open('memo.txt').read())", snapshot_id=snap["snapshot_id"]))
+client.close()
+```
+
+## Docker
+
+```bash
+docker compose up agentbox        # start API on :8080
+docker compose run --rm test    # run unit tests
+```
+
+## Configuration
+
+| Variable | Default | Description |
+|----------|---------|-------------|
+| `AGENTBOX_HOST` | `0.0.0.0` | Bind host |
+| `AGENTBOX_PORT` | `8080` | Bind port |
+| `AGENTBOX_DEFAULT_TIMEOUT_SECONDS` | `30` | Execution timeout |
+| `AGENTBOX_DEFAULT_MEMORY_MB` | unset | Optional default `RLIMIT_AS` cap |
+| `AGENTBOX_SANDBOX_BACKEND` | `subprocess` | Backend selector |
+| `AGENTBOX_SNAPSHOT_DIR` | `/tmp/agentbox-snapshots` | Workspace snapshot store |
+
+## Running tests
+
+```bash
+pytest tests/ -v
+```
+
+## Roadmap
+
+- [x] Node.js runtime + TypeScript client + per-run timeout
+- [x] Filesystem snapshot/restore (tar workspaces)
+- [x] `limits.memory_mb` via `RLIMIT_AS`
+- [ ] gVisor runsc backend with warm pool
+- [ ] Default-deny egress with allowlists (kernel netns)
+
+## License
+
+MIT
+
+## Known limitations (v0.4)
+
+- Subprocess sandbox only — **not production-grade isolation**
+- `RLIMIT_AS` is a soft address-space cap, not a cgroup memory controller
+- Credential stripping is not a network namespace
+- Single-node, no warm pool
+- TypeScript client is source-only (not published to npm)

agentbox_sandbox-0.4.0/README.md

@@ -0,0 +1,148 @@
+# agentbox
+
+Self-hosted **code execution sandbox** for AI agents — one `docker compose up` gives you an HTTP API for running untrusted code in isolated environments.
+
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
+[![Python 3.11+](https://img.shields.io/badge/python-3.11+-blue.svg)](https://www.python.org/downloads/)
+[![CI](https://github.com/yashshah9/agentbox/actions/workflows/ci.yml/badge.svg)](https://github.com/yashshah9/agentbox/actions/workflows/ci.yml)
+
+> **Status:** v0.4 — Python + Node subprocess sandbox, timeouts, `limits.memory_mb` via `RLIMIT_AS`, TypeScript client, workspace snapshots.
+
+## 60-second try
+
+```bash
+docker compose up agentbox        # API on :8080
+# in another shell:
+curl -s http://localhost:8080/health
+curl -s -X POST http://localhost:8080/v1/run \
+  -H 'Content-Type: application/json' \
+  -d '{"code":"print(sum(range(10)))"}'
+docker compose run --rm test      # pytest
+```
+
+## Why this vs alternatives
+
+| Approach | Strength | Gap |
+|----------|----------|-----|
+| **agentbox** | Self-hosted HTTP API + SDK, one compose file | Subprocess isolation today, not gVisor |
+| Hosted sandboxes (E2B, etc.) | Strong isolation, managed | Per-second cost; data leaves your network |
+| Raw `docker exec` | Familiar | No agent-oriented API / snapshots / limits |
+| YOLO in the agent process | Zero infra | Full host compromise risk |
+
+## Problem
+
+Every agent that writes and runs code needs a safe execution environment. Teams either YOLO in shared containers or pay per-second for hosted sandboxes. Self-hosting gVisor/Firecracker is weeks of work.
+
+## Key features (v0.4)
+
+- HTTP API: `POST /v1/run` executes Python or JavaScript
+- Per-request `limits.timeout_seconds` (HTTP 408 on timeout)
+- Per-request `limits.memory_mb` (sets `RLIMIT_AS` in the child process; 16–8192)
+- Workspace snapshots: `"snapshot": true` then `"snapshot_id"`
+- Python SDK + TypeScript client (`sdk/ts/client.ts`)
+- Docker image includes Node.js for the JS runtime
+- Credential stripping when the backend is not `unrestricted`
+
+## Architecture
+
+```
+Agent / SDK
+    └── POST /v1/run
+            └── SubprocessSandbox (MVP)
+                    └── (next) gVisor / Docker backend
+```
+
+| Component | Technology | Why |
+|-----------|------------|-----|
+| API | FastAPI | Async-ready, OpenAPI docs, widely adopted |
+| Server | uvicorn | Standard ASGI server |
+| Config | pydantic-settings | Typed env config |
+| Tests | pytest + httpx TestClient | Fast API testing |
+
+## Installation
+
+```bash
+pip install agentbox-sandbox
+pip install -e ".[dev]"
+```
+
+## Usage
+
+### Start server
+
+```bash
+agentbox serve
+# or
+docker compose up agentbox
+```
+
+### Run code
+
+```bash
+curl -X POST http://localhost:8080/v1/run \
+  -H 'Content-Type: application/json' \
+  -d '{"code": "print(sum(range(10)))"}'
+
+curl -X POST http://localhost:8080/v1/run \
+  -H 'Content-Type: application/json' \
+  -d '{"code": "x = bytearray(10**9)", "limits": {"memory_mb": 64, "timeout_seconds": 5}}'
+```
+
+### Python SDK
+
+```python
+from agentbox.sdk.client import AgentboxClient
+
+client = AgentboxClient("http://localhost:8080")
+print(client.health())
+print(client.run("print('hello')"))
+print(client.run("console.log('hello')", language="javascript", timeout_seconds=5))
+print(client.run("x = bytearray(10**8)", memory_mb=64))
+snap = client.run("open('memo.txt','w').write('kept')", snapshot=True)
+print(client.run("print(open('memo.txt').read())", snapshot_id=snap["snapshot_id"]))
+client.close()
+```
+
+## Docker
+
+```bash
+docker compose up agentbox        # start API on :8080
+docker compose run --rm test    # run unit tests
+```
+
+## Configuration
+
+| Variable | Default | Description |
+|----------|---------|-------------|
+| `AGENTBOX_HOST` | `0.0.0.0` | Bind host |
+| `AGENTBOX_PORT` | `8080` | Bind port |
+| `AGENTBOX_DEFAULT_TIMEOUT_SECONDS` | `30` | Execution timeout |
+| `AGENTBOX_DEFAULT_MEMORY_MB` | unset | Optional default `RLIMIT_AS` cap |
+| `AGENTBOX_SANDBOX_BACKEND` | `subprocess` | Backend selector |
+| `AGENTBOX_SNAPSHOT_DIR` | `/tmp/agentbox-snapshots` | Workspace snapshot store |
+
+## Running tests
+
+```bash
+pytest tests/ -v
+```
+
+## Roadmap
+
+- [x] Node.js runtime + TypeScript client + per-run timeout
+- [x] Filesystem snapshot/restore (tar workspaces)
+- [x] `limits.memory_mb` via `RLIMIT_AS`
+- [ ] gVisor runsc backend with warm pool
+- [ ] Default-deny egress with allowlists (kernel netns)
+
+## License
+
+MIT
+
+## Known limitations (v0.4)
+
+- Subprocess sandbox only — **not production-grade isolation**
+- `RLIMIT_AS` is a soft address-space cap, not a cgroup memory controller
+- Credential stripping is not a network namespace
+- Single-node, no warm pool
+- TypeScript client is source-only (not published to npm)

agentbox_sandbox-0.4.0/SECURITY.md

@@ -0,0 +1,15 @@
+# Security Policy
+
+## Reporting a vulnerability
+
+Email **yash376351@gmail.com** with the repo name, a short description, and steps to reproduce. Please do not open a public issue for exploitable findings until we have had a reasonable chance to respond.
+
+## Threat model (honest)
+
+agentbox executes **untrusted code** on your machine via a subprocess sandbox.
+
+- The current backend is **subprocess + optional `RLIMIT_AS`**, not gVisor/Firecracker. Do **not** expose it to the public internet as-is.
+- Credential stripping and timeouts reduce accidents; they are **not** a kernel isolation story.
+- `limits.memory_mb` caps address space via `RLIMIT_AS` — it is not a cgroup memory controller and behavior differs by OS.
+- Snapshots persist workspace files on disk under `AGENTBOX_SNAPSHOT_DIR`.
+- Prefer running the API only on trusted networks, behind auth you add yourself.

agentbox_sandbox-0.4.0/compose.yaml

@@ -0,0 +1,27 @@
+services:
+  agentbox:
+    build:
+      context: .
+      dockerfile: docker/Dockerfile
+      target: runtime
+    ports:
+      - "8080:8080"
+    environment:
+      AGENTBOX_LOG_LEVEL: INFO
+      AGENTBOX_DEFAULT_TIMEOUT_SECONDS: 30
+      AGENTBOX_SNAPSHOT_DIR: /tmp/agentbox-snapshots
+    healthcheck:
+      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8080/health')"]
+      interval: 10s
+      timeout: 5s
+      retries: 3
+
+  test:
+    build:
+      context: .
+      dockerfile: docker/Dockerfile
+      target: dev
+    volumes:
+      - .:/app
+    working_dir: /app
+    command: ["pytest", "tests/", "-v"]

agentbox_sandbox-0.4.0/docker/Dockerfile

@@ -0,0 +1,19 @@
+FROM python:3.12-slim AS base
+WORKDIR /app
+ENV PYTHONDONTWRITEBYTECODE=1 PYTHONUNBUFFERED=1
+RUN apt-get update && apt-get install -y --no-install-recommends nodejs && rm -rf /var/lib/apt/lists/*
+
+FROM base AS dev
+COPY pyproject.toml README.md ./
+COPY src ./src
+COPY tests ./tests
+RUN pip install --no-cache-dir -e ".[dev]"
+CMD ["pytest", "tests/", "-v"]
+
+FROM base AS runtime
+COPY pyproject.toml README.md ./
+COPY src ./src
+RUN pip install --no-cache-dir .
+EXPOSE 8080
+HEALTHCHECK CMD python -c "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8080/health')"
+CMD ["agentbox", "serve", "--host", "0.0.0.0", "--port", "8080"]

agentbox_sandbox-0.4.0/plans/README.md

@@ -0,0 +1,6 @@
+# agentbox — Planning Documents
+
+| Document | Status | Description |
+|----------|--------|-------------|
+| [v0.1-completed-foundation.md](./v0.1-completed-foundation.md) | **Completed** | Initial foundation release |
+| [v0.2-next-phase-roadmap.md](./v0.2-next-phase-roadmap.md) | **In Progress** | v0.2.0 shipped Node + timeouts + TS client; gVisor still open |