code-sandboxes 1.8.0__tar.gz → 1.9.1__tar.gz

{code_sandboxes-1.8.0 → code_sandboxes-1.9.1}/.github/workflows/build.yml

@@ -16,7 +16,7 @@ jobs:
     uses: ./.github/workflows/reusable-python.yml
     with:
       python-version: ${{ matrix.python-version }}
-      install-extras: test,typing
+      install-extras: test,typing,datalayer
       extra-packages: dbus-python keyring secretstorage
       run-tests: true
       test-command: pytest tests/ --cov=code_sandboxes --cov-report term-missing

code_sandboxes-1.9.1/.github/workflows/environments-live.yml

@@ -0,0 +1,181 @@
+name: Environments Live Matrix
+
+# The managed Environment builders (E2-03, E2-04, E2-05) against the real
+# providers, nightly (PLAN_ENV.md E2-11): a real, hash-verified lock, a real
+# build, a real launch, and the formal core tier — tests/test_environment_live_matrix.py.
+#
+# E2B and Modal carry their own already-documented, unticked gaps there
+# (E2-03's uid/gid mismatch; modal_sandbox.py's missing setpriv) and are
+# `xfail(strict=False)` in that file, so an ordinary failure there is
+# expected and does not fail this workflow. Daytona carries no such marker:
+# a failure there is a real regression, and this workflow opens (or
+# comments on) an issue naming it.
+#
+# Needs, as repository secrets: E2B_API_KEY, DAYTONA_API_KEY, MODAL_TOKEN_ID,
+# MODAL_TOKEN_SECRET, AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY — the last two
+# scoped to read the approved base from ECR only (D-18). A secret that is
+# not set is not a workflow failure: the test each secret belongs to skips,
+# by name, and says so in the job summary.
+
+on:
+  schedule:
+    # 04:17 UTC: off-peak for every provider this reaches, and away from the
+    # hour boundary every other scheduled workflow in this org tends to pick.
+    - cron: '17 4 * * *'
+  workflow_dispatch: {}
+
+concurrency:
+  group: ${{ github.workflow }}
+  cancel-in-progress: false
+
+# The default token on this repository is read-only: without this, a genuine
+# matrix failure would still 403 trying to label and open the issue that is
+# meant to report it (found in review).
+permissions:
+  contents: read
+  issues: write
+
+jobs:
+  live-matrix:
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Setup UV
+        uses: astral-sh/setup-uv@v7
+        with:
+          version: latest
+          python-version: '3.13'
+          activate-environment: true
+
+      - name: Install dependencies
+        run: |
+          uv pip install ".[e2b,daytona,modal,test]"
+          uv pip install boto3
+
+      - name: Configure AWS credentials
+        run: |
+          mkdir -p ~/.aws
+          {
+            echo "[default]"
+            echo "aws_access_key_id=${AWS_ACCESS_KEY_ID}"
+            echo "aws_secret_access_key=${AWS_SECRET_ACCESS_KEY}"
+          } > ~/.aws/credentials
+        env:
+          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+
+      - name: Run the live matrix
+        id: live
+        continue-on-error: true
+        run: |
+          CODE_SANDBOXES_LIVE=1 pytest -q -m live \
+            tests/test_environment_live_matrix.py \
+            --junitxml=live-matrix-results.xml
+        env:
+          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          AWS_REGION: us-east-1
+          E2B_API_KEY: ${{ secrets.E2B_API_KEY }}
+          DAYTONA_API_KEY: ${{ secrets.DAYTONA_API_KEY }}
+          MODAL_TOKEN_ID: ${{ secrets.MODAL_TOKEN_ID }}
+          MODAL_TOKEN_SECRET: ${{ secrets.MODAL_TOKEN_SECRET }}
+
+      - name: Upload the JUnit report
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: environments-live-results
+          path: live-matrix-results.xml
+          retention-days: 14
+
+      - name: Summarize genuine failures (not xfail) naming provider and check
+        if: steps.live.outcome == 'failure'
+        run: |
+          python - <<'PY'
+          import xml.etree.ElementTree as ET
+
+          tree = ET.parse("live-matrix-results.xml")
+          lines = []
+          for testcase in tree.getroot().iter("testcase"):
+              # An expected-fail (E2B/Modal's own documented gaps) is reported
+              # by pytest's junit writer as its own case with neither
+              # <failure> nor <error> — only a genuine, un-marked failure
+              # (Daytona, or a real regression anywhere else) has one.
+              node = testcase.find("failure")
+              if node is None:
+                  node = testcase.find("error")
+              if node is None:
+                  continue
+              name = f"{testcase.get('classname')}::{testcase.get('name')}"
+              detail = (node.get("message") or node.text or "").strip()
+              short = "\n".join(detail.splitlines()[:20])
+              lines.append(f"### `{name}`\n\n```\n{short}\n```")
+
+          with open("failures.md", "w") as handle:
+              handle.write("\n\n".join(lines))
+          print(f"{len(lines)} genuine failure(s) found")
+          PY
+
+      - name: Ensure the environments-live label exists
+        if: steps.live.outcome == 'failure'
+        continue-on-error: true # already existing is not an error
+        uses: actions/github-script@v7
+        with:
+          script: |
+            await github.rest.issues.createLabel({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              name: 'environments-live',
+              color: 'b60205',
+              description: 'The nightly Environments live matrix (E2-11)',
+            });
+
+      - name: Open or update an issue naming the provider and the check
+        if: steps.live.outcome == 'failure'
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const fs = require('fs');
+            const detail = fs.readFileSync('failures.md', 'utf8').trim();
+            if (!detail) {
+              // Every failure was inside an `xfail` — nothing genuinely
+              // broke (see the module docstring's own reasoning).
+              return;
+            }
+            const runUrl = `${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`;
+            const body = [
+              `The nightly [environments live matrix](${runUrl}) failed for real — not the two already-documented \`xfail\` gaps (E2-03's uid/gid, Modal's missing \`setpriv\`).`,
+              '',
+              detail,
+            ].join('\n');
+            const title = 'environments-live: nightly failure';
+            const existing = await github.rest.issues.listForRepo({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              state: 'open',
+              labels: 'environments-live',
+            });
+            const found = existing.data.find((issue) => issue.title === title);
+            if (found) {
+              await github.rest.issues.createComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: found.number,
+                body,
+              });
+            } else {
+              await github.rest.issues.create({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                title,
+                body,
+                labels: ['environments-live'],
+              });
+            }
+
+      - name: Fail the job if something genuinely broke
+        if: steps.live.outcome == 'failure'
+        run: exit 1

{code_sandboxes-1.8.0 → code_sandboxes-1.9.1}/.github/workflows/py-tests.yml

@@ -37,7 +37,7 @@ jobs:
     uses: ./.github/workflows/reusable-python.yml
     with:
       python-version: ${{ matrix.python-version }}
-      install-extras: test
+      install-extras: test,datalayer
       extra-packages: dbus-python keyring secretstorage
       run-tests: true
       test-command: pytest tests/ --cov=code_sandboxes --cov-report term-missing

{code_sandboxes-1.8.0 → code_sandboxes-1.9.1}/.pre-commit-config.yaml

@@ -9,6 +9,11 @@ repos:
       - id: check-case-conflict
       - id: check-executables-have-shebangs
       - id: requirements-txt-fixer
+        # Datalayer's protected constraints (PLAN_ENV.md, E1-04): the header
+        # explains why it is ordered the way it is, and the fixer's sort
+        # would push that header below a package line rather than order the
+        # packages beneath it.
+        exclude: ^code_sandboxes/environments/constraints/sandbox-contract-v1\.txt$
       - id: check-added-large-files
       - id: check-case-conflict
       - id: check-toml

{code_sandboxes-1.8.0 → code_sandboxes-1.9.1}/CHANGELOG.md

@@ -8,11 +8,108 @@
 
 ## Unreleased
 
+## 1.9.1
+
+- **mTLS to the build pool's `buildkitd`** (`environments.adapters.datalayer.Builder`,
+  `environments.resolve.BuildkitResolveRunner`; PLAN_ENV.md E1-06/E1-07). Both
+  drivers of `buildctl` took only `--addr`, which is what every prior live
+  drill needed against a plain-socket, ephemeral `buildkitd` — never a real
+  one. The build pool's real daemon on r1 takes mTLS connections only, so
+  reaching it needed three more flags neither driver had: `--tlscert`,
+  `--tlskey` and `--tlscacert`, each read from `DATALAYER_BUILDKIT_TLSCERT`,
+  `DATALAYER_BUILDKIT_TLSKEY` and `DATALAYER_BUILDKIT_TLSCACERT` when not
+  passed explicitly (`Builder`, matching how it already reads
+  `DATALAYER_BUILDKIT_ADDR`) or passed in by the caller (`BuildkitResolveRunner`,
+  constructed by durable's own `activities_environments.py`, which now reads
+  and forwards the same three). All three or none — a partial set is treated
+  as none, since a `buildkitd` requiring mTLS refuses a client carrying only
+  some of them at the daemon, with a less useful error than refusing here.
+
+## 1.9.0
+
+- **The Daytona builder** (`environments.adapters.daytona`, PLAN_ENV.md
+  E2-04). A snapshot built from the approved Datalayer base — `uv pip sync --require-hashes` against the resolved lock, your files, `postInstall`
+  commands, and an explicit `tini -- sleep infinity` entrypoint — with the
+  owner's own Daytona organization, never this package's ambient
+  credentials. Confirmed live against a real, hash-verified lock: a real
+  snapshot reaches `Active` and a sandbox launched from it passes the full
+  sandbox contract, doctor included — the one managed variant, of the
+  three landing here, whose build-time state and launched state fully
+  agree.
+- **The E2B builder** (`environments.adapters.e2b`, PLAN_ENV.md E2-03). A
+  template built from `code-interpreter-v1` — E2B's own proprietary
+  code-interpreter server ships baked into it only, so the build starts
+  there rather than from the Datalayer base and reconciles whatever it
+  shipped to exactly what the lock pins. Two live-found identity bugs are
+  fixed: `code-interpreter-v1` already holds an account at uid 1000 and a
+  group at gid 100 of its own, so the old `useradd` was silently landing
+  elsewhere — the build now renames the existing account instead — and the
+  base sets no locale at all, now set explicitly. A real build passes the
+  contract's doctor check in full. **Still open:** a launched sandbox
+  currently runs as root, not the contract's `1000:100` — the two
+  `systemd` services that actually execute a launched sandbox's code have
+  no `User=` of their own, and E2B's private server hardcodes `/home/user`
+  as the working directory, independent of anything the build sets.
+- **The Modal builder** (`environments.adapters.modal`, PLAN_ENV.md E2-05).
+  An image built `from_aws_ecr` off the approved base, with a per-build
+  Secret made and torn down around it. The contract's own identity is put
+  back at launch: `modal_sandbox.py`'s session driver now drops itself to
+  `1000:100` for a sandbox launched from a built Environments artifact
+  specifically (gated on `image_id`, so general Modal sandbox usage
+  elsewhere is unaffected) — Modal ignores the image's own `USER`, so this
+  is the only place it can be restored. A separate, previously
+  silently-fatal bug is also fixed: the real launcher creates the sandbox
+  with no command arguments at all, so an entrypoint relying on `exec "$@"` alone was a no-op and every launched environment exited within
+  seconds; the entrypoint now falls back to `sleep infinity` when given
+  none. **Still open:** two of the core tier's checks (imports, filesystem)
+  still fail on a launched sandbox, for a reason not yet root-caused —
+  confirmed specific to a contract-built image under repeated `exec`, not
+  the identity fix.
+- **A real, shared bug in all three managed launchers, found in review**:
+  `start()` creates the remote sandbox well before it marks itself
+  started, while `stop()` was guarded on that flag rather than on the
+  resource itself — a failure in between left a real, running sandbox
+  that `stop()` skipped entirely, orphaned for good. Fixed identically in
+  `daytona_sandbox.py`, `modal_sandbox.py` and `e2b_sandbox.py`.
+- **A nightly live matrix for the three managed builders**
+  (`.github/workflows/environments-live.yml`, PLAN_ENV.md E2-11). Builds a
+  real artifact on each real provider from a real, hash-verified lock,
+  launches a sandbox from it, and runs the formal core tier — opening (or
+  commenting on) an issue naming the provider and the check on a genuine
+  failure. E2B and Modal run `xfail(strict=False)` for their own
+  already-documented gaps above; Daytona carries no such marker. Needs
+  provider secrets added to the repository before it does anything for
+  real.
+
+## 1.8.2
+
+- **A sandbox can be asked whether it is still alive, and the answer no longer
+  comes from a flag we set ourselves.** `CodeSandboxClient.is_alive()` returned
+  `is_started`, which records that `start()` ran in this process and nothing
+  else, so it kept answering `True` after the backend was gone. `Sandbox` now
+  carries an `is_alive()` that variants override; the Jupyter Server variant
+  looks its kernel id up on the server the way `_find_existing_kernel` lists
+  them, and the client asks the sandbox instead of reading its own flag.
+  Variants that have no way to ask their provider inherit the base answer,
+  `is_started`, which is all they can honestly say.
+- **Build secrets** (`environments.build_secrets`, PLAN_ENV.md E3-05).
+  `spec.buildSecrets` now resolves for real on the Datalayer variant: each
+  declared secret's value is fetched from IAM's own internal route at the
+  moment the `postInstall` step runs, mounted with BuildKit's
+  `--mount=type=secret` (an environment variable or a file under
+  `/run/secrets/`, per `mountAs`) in its own directory outside the build
+  context, and passed to `buildctl` by file path — never in argv, never in a
+  step result, never an `ARG`/`ENV` that would bake it into the image's
+  history. E2B and Daytona refuse a spec naming one outright: E0-04's spike
+  found only a registry login for the private base on either, never a
+  per-step arbitrary secret. A version with any build secret can never be
+  published to the Library (D-12). New codes `DL_ENV_BUILD_SECRET_UNAVAILABLE`
+  and `DL_ENV_PUBLICATION_BLOCKED`.
+
 ## 1.8.0
 
 - **The Datalayer builder** (`environments.adapters.datalayer`, PLAN_ENV.md
-  E1-07). The Dockerfile is generated from the lock — `uv pip sync
-  --require-hashes`, apt at the versions the lock recorded, `env` before
+  E1-07). The Dockerfile is generated from the lock — `uv pip sync --require-hashes`, apt at the versions the lock recorded, `env` before
   anything installs, `postInstall` as uid 1000 with no network — and the push
   is by digest with an SBOM and provenance attestation, under the operability
   tag `v<n>-<build_uid>` so a retried build cannot collide with the attempt
@@ -80,8 +177,7 @@
   pinned exceptions left.
 
 - A Datalayer sandbox says when it is running code, so an interrupt can reach
-  it. `Sandbox.interrupt` refuses before it delegates — `if not
-  self._executing_event.is_set(): return False` — and `run_code` never set that
+  it. `Sandbox.interrupt` refuses before it delegates — `if not self._executing_event.is_set(): return False` — and `run_code` never set that
   event, so `is_executing` was always False, every interrupt was refused at the
   door, and the refusal was reported as "no code was running" to a caller
   watching a cell run.

{code_sandboxes-1.8.0 → code_sandboxes-1.9.1}/Makefile

@@ -54,6 +54,11 @@ live-matrix:
 kill-relaunch:
 	CODE_SANDBOXES_LIVE=1 pytest -q -m live tests/test_the_kill_relaunch_drill.py
 
+## The managed Environment builders against the real providers: a real
+## resolved lock, build, launch, and the formal core tier (E2-11).
+environments-live:
+	CODE_SANDBOXES_LIVE=1 pytest -q -m live tests/test_environment_live_matrix.py
+
 clean: ## clean
 	git clean -fdx
 

{code_sandboxes-1.8.0 → code_sandboxes-1.9.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: code_sandboxes
-Version: 1.8.0
+Version: 1.9.1
 Project-URL: Home, https://github.com/datalayer/code-sandboxes
 Author-email: Datalayer <info@datalayer.io>
 License: BSD 3-Clause License
@@ -75,6 +75,7 @@ Provides-Extra: e2b
 Requires-Dist: e2b-code-interpreter>=2.9.1; extra == 'e2b'
 Provides-Extra: environments-builder
 Requires-Dist: boto3>=1.34; extra == 'environments-builder'
+Requires-Dist: httpx>=0.27; extra == 'environments-builder'
 Provides-Extra: google-colab
 Provides-Extra: kaggle
 Requires-Dist: kaggle>=1.6; extra == 'kaggle'
@@ -87,6 +88,7 @@ Requires-Dist: modal>=1.5.2; extra == 'modal'
 Provides-Extra: monty
 Requires-Dist: pydantic-monty; extra == 'monty'
 Provides-Extra: test
+Requires-Dist: httpx>=0.27; extra == 'test'
 Requires-Dist: ipykernel; extra == 'test'
 Requires-Dist: jupyter-server<3,>=1.6; extra == 'test'
 Requires-Dist: pytest-asyncio>=0.21; extra == 'test'
@@ -107,7 +109,7 @@ Description-Content-Type: text/markdown
 [![Become a Sponsor](https://img.shields.io/static/v1?label=Become%20a%20Sponsor&message=%E2%9D%A4&logo=GitHub&style=flat&color=1ABC9C)](https://github.com/sponsors/datalayer)
 [![PyPI - Version](https://img.shields.io/pypi/v/code-sandboxes)](https://pypi.org/project/code-sandboxes)
 
-# { } 📦 Code Sandboxes
+# 📦 Code Sandboxes
 
 Code Sandboxes (`code_sandboxes`) is a Python package for running code in isolated sandbox variants through a unified API.
 

{code_sandboxes-1.8.0 → code_sandboxes-1.9.1}/README.md

@@ -9,7 +9,7 @@
 [![Become a Sponsor](https://img.shields.io/static/v1?label=Become%20a%20Sponsor&message=%E2%9D%A4&logo=GitHub&style=flat&color=1ABC9C)](https://github.com/sponsors/datalayer)
 [![PyPI - Version](https://img.shields.io/pypi/v/code-sandboxes)](https://pypi.org/project/code-sandboxes)
 
-# { } 📦 Code Sandboxes
+# 📦 Code Sandboxes
 
 Code Sandboxes (`code_sandboxes`) is a Python package for running code in isolated sandbox variants through a unified API.
 

{code_sandboxes-1.8.0 → code_sandboxes-1.9.1}/code_sandboxes/__version__.py

@@ -3,4 +3,4 @@
 
 """Code Sandboxes."""
 
-__version__ = "1.8.0"
+__version__ = "1.9.1"

{code_sandboxes-1.8.0 → code_sandboxes-1.9.1}/code_sandboxes/base.py

@@ -198,6 +198,17 @@ class Sandbox(ABC):
         """Check if sandbox has been started."""
         return self._started
 
+    def is_alive(self) -> bool:
+        """Check whether the sandbox is still usable.
+
+        Distinct from :attr:`is_started`, which only records that `start` ran
+        in this process: a sandbox can be culled, evicted or shut down by
+        whoever else holds it, and nothing tells us. The base answer is
+        :attr:`is_started`, all a variant with no way to ask its provider can
+        honestly say; variants that can ask override this.
+        """
+        return self.is_started
+
     @property
     def is_executing(self) -> bool:
         """Check if the sandbox is currently executing code."""
@@ -598,7 +609,7 @@ class Sandbox(ABC):
             # caller passed itself wins, so naming both is not a surprise.
             from .environments.builders import launch_arguments
 
-            for name_, value in launch_arguments(artifact).items():
+            for name_, value in launch_arguments(artifact, expected_variant=variant_value).items():
                 kwargs.setdefault(name_, value)
 
         if variant_value == "eval":
@@ -1078,7 +1089,7 @@ class Sandbox(ABC):
             from .exceptions import VariableNotFoundError
 
             raise VariableNotFoundError(name)
-        return _json.loads(printed[start + len(self._STDOUT_START):end])
+        return _json.loads(printed[start + len(self._STDOUT_START) : end])
 
     def set_variable(self, name: str, value: Any, context: Context | None = None) -> None:
         """Set a variable in the sandbox.

{code_sandboxes-1.8.0 → code_sandboxes-1.9.1}/code_sandboxes/client.py

@@ -497,7 +497,14 @@ class CodeSandboxClient:
         return self._sandbox.interrupt()
 
     def is_alive(self) -> bool:
-        """Whether the sandbox is started and available for execution."""
+        """Whether the wrapped sandbox is still available for execution.
+
+        Asks the sandbox, which may check its provider. Sandboxes that expose
+        no liveness hook fall back to whether they report themselves started.
+        """
+        is_alive_fn = getattr(self._sandbox, "is_alive", None)
+        if callable(is_alive_fn):
+            return bool(is_alive_fn())
         return self.is_started
 
     def restart(self) -> None:

{code_sandboxes-1.8.0 → code_sandboxes-1.9.1}/code_sandboxes/commands.py

@@ -284,7 +284,7 @@ print({_ENVELOPE_START!r} + __cmd_json__.dumps(__cmd_output__) + {_ENVELOPE_END!
                 duration=time.time() - start_time,
             )
         try:
-            result = json.loads(printed[start + len(_ENVELOPE_START):end])
+            result = json.loads(printed[start + len(_ENVELOPE_START) : end])
             return CommandResult(
                 exit_code=int(result["exit_code"]),
                 stdout=str(result["stdout"]),

{code_sandboxes-1.8.0 → code_sandboxes-1.9.1}/code_sandboxes/datalayer_sandbox.py

@@ -55,7 +55,6 @@ from .models import (
     SnapshotInfo,
 )
 
-
 logger = logging.getLogger(__name__)
 
 
@@ -580,10 +579,11 @@ class DatalayerSandbox(Sandbox):
         **This variant neither implemented it nor read the flag**, so the
         base class's default ran instead: it sets a flag, returns `True`, and
         stops nothing. (`google_colab` and `kaggle` are entitled to that
-        default — they poll `_interrupt_requested` and stop cooperatively.) Everything above believed it. `tasks/cancel` marks a
-        task `cancelled` and calls the interrupt registered by
-        `execute_cell`; the interrupt answered yes; the cell went on running
-        on a runtime that goes on being billed.
+        default — they poll `_interrupt_requested` and stop cooperatively.)
+        Everything above believed it. `tasks/cancel` marks a task `cancelled`
+        and calls the interrupt registered by `execute_cell`; the interrupt
+        answered yes; the cell went on running on a runtime that goes on
+        being billed.
 
         Measured on prod1 on 2026-09-07: a cell looping for two minutes,
         cancelled ten seconds in, `tasks/cancel` and `tasks/get` both
@@ -603,13 +603,11 @@ class DatalayerSandbox(Sandbox):
         """
         client = getattr(self._runtime, "sandbox_client", None)
         if client is None:
-            logger.warning(
-                "This sandbox has no runtime client, so nothing could be interrupted"
-            )
+            logger.warning("This sandbox has no runtime client, so nothing could be interrupted")
             return False
         try:
             return bool(client.interrupt())
-        except Exception as error:  # noqa: BLE001 - a failed interrupt is an answer
+        except Exception as error:
             logger.warning("The runtime's kernel could not be interrupted: %s", error)
             return False
 
@@ -817,7 +815,9 @@ class DatalayerSandbox(Sandbox):
         try:
             # Set environment variables if provided
             if envs:
-                env_code = "\n".join(f"import os; os.environ[{k!r}] = {v!r}" for k, v in envs.items())
+                env_code = "\n".join(
+                    f"import os; os.environ[{k!r}] = {v!r}" for k, v in envs.items()
+                )
                 self._runtime.execute(env_code)
 
             response = self._runtime.execute(code, timeout=execution_timeout)

{code_sandboxes-1.8.0 → code_sandboxes-1.9.1}/code_sandboxes/daytona_sandbox.py

@@ -655,17 +655,21 @@ class DaytonaSandbox(Sandbox):
         )
 
     def stop(self) -> None:
-        if not self._started:
+        # Guarded on the resource itself, not `_started` (found in review):
+        # `start()` creates the remote sandbox well before it marks itself
+        # started, so a failure in between — `create_context`, building
+        # `SandboxInfo` — would otherwise leave a real, running sandbox that
+        # `stop()` skips entirely and this object can never clean up again.
+        if self._sandbox is None:
             return
-        if self._sandbox is not None:
-            try:
-                if self._delete_on_stop:
-                    self._sandbox.delete()
-                else:
-                    self._sandbox.stop()
-            except Exception:
-                logger.debug("Ignoring error while stopping the Daytona sandbox", exc_info=True)
-            self._sandbox = None
+        try:
+            if self._delete_on_stop:
+                self._sandbox.delete()
+            else:
+                self._sandbox.stop()
+        except Exception:
+            logger.debug("Ignoring error while stopping the Daytona sandbox", exc_info=True)
+        self._sandbox = None
         self._daytona = None
         self._jupyter_endpoint = None
         self._contexts.clear()

{code_sandboxes-1.8.0 → code_sandboxes-1.9.1}/code_sandboxes/docker_sandbox.py

@@ -10,19 +10,18 @@ through `jupyter-kernel-client` to execute code.
 
 from __future__ import annotations
 
+import logging
 import os
 import tempfile
 import time
 import uuid
 
-import logging
-
 import requests
 
 from .base import Sandbox, marks_execution
-from .jupyter_ingress import interrupt_kernel_client
 from .exceptions import SandboxConfigurationError, SandboxNotStartedError
 from .interfaces import ISandboxClient
+from .jupyter_ingress import interrupt_kernel_client
 from .models import (
     CodeError,
     Context,

{code_sandboxes-1.8.0 → code_sandboxes-1.9.1}/code_sandboxes/e2b_sandbox.py

@@ -419,14 +419,18 @@ class E2BSandbox(Sandbox):
         return self._allow_internet_access
 
     def stop(self) -> None:
-        if not self._started:
+        # Guarded on the resource itself, not `_started` (found in review):
+        # `start()` creates the remote sandbox well before it marks itself
+        # started, so a failure in between — `create_context`, building
+        # `SandboxInfo` — would otherwise leave a real, running sandbox that
+        # `stop()` skips entirely and this object can never clean up again.
+        if self._sandbox is None:
             return
-        if self._sandbox is not None:
-            try:
-                self._sandbox.kill()
-            except Exception:
-                logger.debug("Ignoring error while killing the E2B sandbox", exc_info=True)
-            self._sandbox = None
+        try:
+            self._sandbox.kill()
+        except Exception:
+            logger.debug("Ignoring error while killing the E2B sandbox", exc_info=True)
+        self._sandbox = None
         self._contexts.clear()
         self._jupyter_endpoint = None
         self._volume_mounts.stopped()
@@ -527,11 +531,19 @@ class E2BSandbox(Sandbox):
                 on_result(translated)
 
         seconds = timeout if timeout is not None else self.config.timeout
+        # A language and a context are two ways of saying the same thing to
+        # E2B, and its SDK refuses both at once: "You can provide context or
+        # language, but not both at the same time." A context already carries
+        # the language it was created with, so the context wins when there is
+        # one — which is what check 14 of E0-04 found here (PLAN_ENV E2-02).
+        e2b_context = self._e2b_context(context)
+        chosen: dict[str, Any] = (
+            {"context": e2b_context} if e2b_context is not None else {"language": "python"}
+        )
         try:
             execution = self._sandbox.run_code(
                 code,
-                language="python",
-                context=self._e2b_context(context),
+                **chosen,
                 on_stdout=take_stdout,
                 on_stderr=take_stderr,
                 on_result=take_result,

{code_sandboxes-1.8.0 → code_sandboxes-1.9.1}/code_sandboxes/environments/__init__.py

@@ -16,6 +16,7 @@ provider-specific:
 - :mod:`.spec` — the canonical specification and its rules;
 - :mod:`.resolve` — the lock a version is resolved into, once (D-9);
 - :mod:`.policy` — whether an artifact's scan lets it be used (D-11);
+- :mod:`.accounts` — whose provider account a managed artifact lives in (D-8);
 - :mod:`.attest` — the scan and the signature it needs before anything runs it;
 - :mod:`.contract` — ``sandbox-contract/v1`` and the Dockerfile validator;
 - :mod:`.lifecycle` — the version states and their legal moves;
@@ -30,6 +31,7 @@ The builders themselves are in :mod:`.adapters`, loaded by variant.
 
 from __future__ import annotations
 
+from .accounts import account_fingerprints, fingerprint_matches, provider_account
 from .attest import Attestor, attest_artifact, signature_tag
 from .bases import APPROVED_BASES, ApprovedBase
 from .builders import (
@@ -106,6 +108,7 @@ __all__ = [
     "ScanPolicy",
     "ValidationResult",
     "VersionState",
+    "account_fingerprints",
     "attest_artifact",
     "build_outcome",
     "can_transition",
@@ -113,6 +116,7 @@ __all__ = [
     "canonical_json",
     "check_dockerfile",
     "decide",
+    "fingerprint_matches",
     "get_builder",
     "locked_versions",
     "map_provider_error",
@@ -120,6 +124,7 @@ __all__ = [
     "parse_environment",
     "parse_resolver_failure",
     "protected_pins",
+    "provider_account",
     "refuse_if_blocked",
     "resolve_environment",
     "signature_tag",