exec-sandbox 0.22.0__tar.gz → 1.0.1__tar.gz

exec_sandbox-1.0.1/.claude/settings.json

@@ -0,0 +1,12 @@
+{
+  "$schema": "https://json.schemastore.org/claude-code-settings.json",
+  "attribution": {
+    "commit": "",
+    "pr": ""
+  },
+  "permissions": {
+    "defaultMode": "auto"
+  },
+  "alwaysThinkingEnabled": true,
+  "effortLevel": "xhigh"
+}

exec_sandbox-1.0.1/.codex/config.toml

@@ -0,0 +1,8 @@
+#:schema https://developers.openai.com/codex/config-schema.json
+
+approval_policy = "on-request"
+approvals_reviewer = "auto_review"
+model_reasoning_effort = "max"
+plan_mode_reasoning_effort = "max"
+project_doc_fallback_filenames = ["CLAUDE.md"]
+sandbox_mode = "danger-full-access"

exec_sandbox-1.0.1/.github/runs-on.yml

@@ -0,0 +1,59 @@
+# RunsOn runner profiles — diversify eligible EC2 capacity.
+# Docs: https://runs-on.com/docs/runners/labels/
+#       https://runs-on.com/docs/runners/custom/
+#
+# Family entries are prefixes: c9 admits c9g, c9gd, and other matching variants.
+# The image selects the architecture; CPU, RAM, regional offerings, and capacity
+# further constrain selection. Listing a generation does not force its use.
+#
+# The 2–4 GiB per vCPU band avoids tiny burstable instances and excludes R-series
+# shapes at these CPU counts. Job labels can override profile defaults.
+# Family-list order does not prioritize newer generations.
+
+runners:
+  # ARM64 (Graviton) — compute + general-purpose + burstable
+  1cpu-linux-arm64: &arm64
+    cpu: 1
+    ram: [2, 4]
+    image: ubuntu24-full-arm64
+    family: ["c7", "m7", "r7", "c8", "m8", "t4g", "c9", "m9", "r9"]
+
+  2cpu-linux-arm64:
+    <<: *arm64
+    cpu: 2
+    ram: [4, 8]
+
+  4cpu-linux-arm64:
+    <<: *arm64
+    cpu: 4
+    ram: [8, 16]
+
+  8cpu-linux-arm64:
+    <<: *arm64
+    cpu: 8
+    ram: [16, 32]
+
+  # x64 — Intel + AMD
+  # /nested-virt further restricts selection to supported x64 instance types;
+  # the profile's CPU/RAM filters still apply.
+  # https://runs-on.com/docs/runners/capabilities/nested-virtualization/
+  1cpu-linux-x64: &x64
+    cpu: 1
+    ram: [2, 4]
+    image: ubuntu24-full-x64
+    family: ["c7", "m7", "r7", "c8", "m8", "r8", "c9", "m9", "r9"]
+
+  2cpu-linux-x64:
+    <<: *x64
+    cpu: 2
+    ram: [4, 8]
+
+  4cpu-linux-x64:
+    <<: *x64
+    cpu: 4
+    ram: [8, 16]
+
+  8cpu-linux-x64:
+    <<: *x64
+    cpu: 8
+    ram: [16, 32]

{exec_sandbox-0.22.0 → exec_sandbox-1.0.1}/.github/workflows/release.yml

@@ -136,7 +136,7 @@ jobs:
           path: dist/
 
       - name: Publish to TestPyPI
-        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # release/v1
+        uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3
         with:
           repository-url: https://test.pypi.org/legacy/
           attestations: true
@@ -160,7 +160,7 @@ jobs:
           path: dist/
 
       - name: Publish to PyPI
-        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # release/v1
+        uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3
         with:
           attestations: true
           print-hash: true

{exec_sandbox-0.22.0 → exec_sandbox-1.0.1}/.github/workflows/test.yml

@@ -45,6 +45,9 @@ jobs:
           uv run pyright .
           uv run -m vulture src/ scripts/ --min-confidence 80
 
+      - name: Package checks
+        run: make test-package
+
   static-rust-guest-agent:
     name: Static / Rust (guest-agent)
     runs-on: ubuntu-24.04-arm

{exec_sandbox-0.22.0 → exec_sandbox-1.0.1}/.gitignore

@@ -110,7 +110,7 @@ db.sqlite3
 db.sqlite3-journal
 
 # Flask stuff:
-instance/
+/instance/
 .webassets-cache
 
 # Scrapy stuff:

{exec_sandbox-0.22.0 → exec_sandbox-1.0.1}/CLAUDE.md

@@ -2,6 +2,19 @@
 
 See @README for project overview and @Makefile for available commands for this project.
 
+Always use ASD-STE100 Simplified Technical English in responses to the user.
+
+## Writing — Orwell’s six rules
+
+For prose—not code, identifiers, commands, exact quotations, or error text—follow George Orwell’s rules from “Politics and the English Language”:
+
+1. Avoid stock metaphors, similes, and other figures of speech.
+2. Prefer a short, familiar word when it is equally precise.
+3. Cut every word that adds no meaning.
+4. Prefer active voice when it is clearer.
+5. Prefer everyday English to foreign phrases, needless scientific terms, or jargon; keep exact technical terms when precision requires them.
+6. Break any rule before making the prose unclear, inaccurate, unsafe, or unnatural.
+
 ## Code search — use `seek`
 
 Prefer `seek` over grep/ripgrep for code search. It returns BM25-ranked results with context and symbol tags.

{exec_sandbox-0.22.0 → exec_sandbox-1.0.1}/Makefile

@@ -58,7 +58,7 @@ install-seek:
 	@curl -sSfL https://raw.githubusercontent.com/dualeai/seek/main/install.sh | sh
 
 install-deps:
-	uv sync --extra dev --extra s3
+	uv sync --extra dev --extra s3 --extra cli
 
 # Build QEMU from source (Linux CI only — Ubuntu 24.04 ships 8.2.2 with ARM64 TCG bugs)
 # Usage: make build-qemu [QEMU_PREFIX=~/qemu-build]
@@ -100,7 +100,7 @@ build:
 	@echo "🔨 Building QEMU images (arch=$(IMAGE_ARCH), variant=$(IMAGE_VARIANT))..."
 	./scripts/build-images.sh $$(echo "$(IMAGE_ARCH)" | sed 's/arm64/aarch64/') $(IMAGE_VARIANT)
 
-# Kept as alias for backwards compatibility and CI scripts.
+# Alias of build.
 build-images: build
 
 # ============================================================================
@@ -118,13 +118,14 @@ test-static:
 	uv run -m vulture src/ scripts/ --min-confidence 80
 	shellcheck scripts/*.sh cicd/*.sh
 	$(MAKE) test-kernel-hash-sync
+	$(MAKE) test-package
 	$(MAKE) --directory guest-agent test-static
 	$(MAKE) --directory tiny-init test-static
 	$(MAKE) --directory gvproxy-wrapper test-static
 
 # Kernel hash functions must stay byte-identical between the two scripts:
 # extract-kernel.sh writes the .hash sidecar that build-kernel.sh reads —
-# divergence makes extract-kernel serve a stale vmlinux/initramfs silently.
+# divergence makes extract-kernel.sh serve a stale vmlinuz/vmlinux silently.
 test-kernel-hash-sync:
 	@a=$$(mktemp) && b=$$(mktemp) && \
 		sed -n '/^compute_hash() {/,/^}/p' scripts/build-kernel.sh | tail -n +2 > "$$a" && \
@@ -132,6 +133,13 @@ test-kernel-hash-sync:
 		{ diff "$$a" "$$b" || { echo "ERROR: compute_hash (build-kernel.sh) and compute_kernel_hash (extract-kernel.sh) diverged"; rm -f "$$a" "$$b"; exit 1; }; } && \
 		rm -f "$$a" "$$b"
 
+# Build the sdist and wheel into a temporary folder, then run the twine check of
+# release.yml (Verify build artifacts): a build-backend or metadata-version change
+# fails here, before the merge, not at release time.
+test-package:
+	@out=$$(mktemp -d) && \
+		{ uv build --out-dir "$$out" && uv run twine check "$$out"/*; rc=$$?; rm -rf "$$out"; exit $$rc; }
+
 # CI resource monitor — wraps a command with background metrics collection.
 # Runs in a single shell: start monitor, run command, kill monitor, propagate exit code.
 # Usage: $(call ci-monitor-run,<command>)
@@ -200,8 +208,9 @@ bench-pool:
 	uv run python scripts/benchmark_latency.py -n 10 --pool $(BENCH_POOL)
 
 # 2D overcommit optimizer — finds Pareto-optimal (CPU_OC, MEM_OC) configs.
-# Fires N VMs per combo across a 4x4 grid, ranks by Sharpe-like efficiency
-# (throughput / RSS fraction), and reports the efficient frontier.
+# Fires N VMs per combo across a 4x4 grid, ranks by latency efficiency
+# (10^6 / geometric mean of the admission, setup and exec p95), and reports
+# the efficient frontier.
 # Run on a KVM-capable host for production-representative results.
 # Usage: make bench-optimizer [N_VMS=200]
 bench-optimizer:
@@ -210,7 +219,7 @@ bench-optimizer:
 # VM density benchmark — measures host memory cost per VM.
 # Boots N VMs, holds them alive, samples host memory to compute marginal cost.
 # Usage: make bench-density [N_VMS=10]
-#        make bench-density-sweep          # sweep N=5,10,20 VMs
+#        make bench-density-sweep          # sweep N=3,5,10 VMs
 bench-density:
 	uv run --script scripts/benchmark_density.py $(if $(N_VMS),-n $(N_VMS),) --workload