maf-sandbox-codeact 0.7.0__tar.gz → 0.7.2__tar.gz

{maf_sandbox_codeact-0.7.0 → maf_sandbox_codeact-0.7.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: maf-sandbox-codeact
-Version: 0.7.0
+Version: 0.7.2
 Summary: CodeAct as a Microsoft Agent Framework tool — the model writes a short Python program and it runs inside a sandbox — written against maf-sandbox so it runs on any sandbox backend.
 Keywords: codeact,code-execution,sandbox,agent-framework,microsoft-agent-framework
 Author: SOKOLAI BV
@@ -15,7 +15,7 @@ Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
 Classifier: Programming Language :: Python :: 3.14
 Classifier: Topic :: Software Development :: Interpreters
-Requires-Dist: maf-sandbox>=0.19.0,<0.21
+Requires-Dist: maf-sandbox>=0.20.0,<0.22
 Requires-Dist: agent-framework-core>=1.13.0,<2
 Requires-Python: >=3.12, <3.15
 Project-URL: Homepage, https://www.sokol.ai
@@ -132,6 +132,21 @@ Naming a host is a real widening, and worth naming as such: this sandbox runs mo
 
 **Isolation is the host's call, and a store changes what that call is about.** This kind does not raise `SandboxSpec.min_isolation`, so the router's floor governs — `MICROVM` unless the host opted down. A kind that ran code influenced by untrusted external content would pin the floor itself, and this one cannot know whether it is one: with no store and no allowlist, the program's only input is source the model wrote, and opting down to `CONTAINER` weighs model-written code against a shared kernel. **With a store the program also reads whatever those files contain, and with an allowlist whatever an allowed host returns** — so the floor should be chosen against the provenance of everything the program can read, not against this kind's defaults. Only the host knows that.
 
+## Upgrading to 0.7
+
+`0.7.0` requires `maf-sandbox` 0.19, which made the egress mode a thing a workload declares.
+
+**`codeact_sandbox_spec`'s signature is unchanged** — there is no `egress` parameter to pass, because the mode follows from what you already say: name hosts in `egress_allow` and the spec runs in `Egress.ALLOWLIST`, name none and it runs in `Egress.CLOSED`. Nothing to edit.
+
+**What changed is what the router does with it.** A backend that cannot enforce the resulting mode is refused at attach rather than permitted with a warning, so a host that wired an allowlist against a backend confining everything used to get a program that failed at the fetch and now gets:
+
+```
+SandboxEgressNotEnforced: sandbox backend 'docker' cannot enforce the 'allowlist'
+egress the 'codeact' workload runs in (it enforces closed).
+```
+
+Give the backend a mode it can enforce — for `maf-sandbox-docker`, configure `egress_proxy_image` — or drop `egress_allow` and let the program run closed. The refusal is deliberate: a program that silently could not reach what its host meant to allow is the failure this replaces.
+
 ## Upgrading to 0.3
 
 `0.3.0` follows `maf-sandbox` 0.11, which retired the word `workspace` from the vocabulary. It requires that release.
@@ -140,7 +155,7 @@ Naming a host is a real widening, and worth naming as such: this sandbox runs mo
 
 ## What this version is not
 
-The `RUN_CODE` road served by an embedded-interpreter backend is absent on purpose — this kind only ever asks for `EXEC`. Host-tool dispatch is wired (`host_tools`, above), two shipped backends serve it, and what it costs has been measured: [`samples/15_acas_codeact_host_tools`](https://github.com/sokolaidev/maf-extensions/tree/main/samples/15_acas_codeact_host_tools) walks a four-stage lookup on ACAS twice, once dispatched and once through the model's own tool loop, and publishes both against wall clock and tokens ([#302](https://github.com/sokolaidev/maf-extensions/issues/302)). The short version: a dispatch is a serial round trip of about a second. On the run that sample documents it walked the stages in three tool-calling rounds against the direct route's five, and none of the twelve sales figures were written into a call the model made — what comes back to it is the program's finished table. The design that governs capabilities — declared by backends, required by specs, and what `HOST_TOOLS` carries — is [`docs/design/two-axis-sandbox-policy.md`](https://github.com/sokolaidev/maf-extensions/blob/main/docs/design/two-axis-sandbox-policy.md); the file channels above are specified in [`docs/design/files-out.md`](https://github.com/sokolaidev/maf-extensions/blob/main/docs/design/files-out.md).
+The `RUN_CODE` road served by an embedded-interpreter backend is absent on purpose — this kind only ever asks for `EXEC`. Host-tool dispatch is wired (`host_tools`, above), two shipped backends serve it, and what it costs has been measured: [`samples/15_acas_codeact_host_tools`](https://github.com/sokolaidev/maf-extensions/tree/main/samples/15_acas_codeact_host_tools) walks a four-stage lookup on ACAS twice, once dispatched and once through the model's own tool loop, and publishes both against wall clock and tokens ([#302](https://github.com/sokolaidev/maf-extensions/issues/302)). The short version: a dispatch is a serial round trip of about a second. On the run that sample documents it walked the stages in three tool-calling rounds against the direct route's five, and none of the twelve sales figures were written into a call the model made — what comes back to it is the program's finished table. The design that governs capabilities — declared by backends, required by specs, and what `HOST_TOOLS` carries — is [`docs/sandbox/capabilities.md`](https://github.com/sokolaidev/maf-extensions/blob/main/docs/sandbox/capabilities.md), which specifies the file channels above as well; where an artifact lands, and what a dispatched host tool may do, is [`docs/sandbox/hosts.md`](https://github.com/sokolaidev/maf-extensions/blob/main/docs/sandbox/hosts.md).
 
 The sandbox protocol's delete surface is capability-gated, and this kind does not require `FILES_DELETE`. It therefore uses a fresh directory per call for staleness isolation, while the framework reclaims that directory, and everything under it, when the call returns. A program that walks upwards can still open files outside its own directory during the call. The fresh directory removes staleness from the *namespace*, so a program reading `data.csv` gets this call's or nothing. Everything reachable that way belongs to the same conversation and the same agent, since that is what a sandbox is keyed by.
 

{maf_sandbox_codeact-0.7.0 → maf_sandbox_codeact-0.7.2}/README.md

@@ -107,6 +107,21 @@ Naming a host is a real widening, and worth naming as such: this sandbox runs mo
 
 **Isolation is the host's call, and a store changes what that call is about.** This kind does not raise `SandboxSpec.min_isolation`, so the router's floor governs — `MICROVM` unless the host opted down. A kind that ran code influenced by untrusted external content would pin the floor itself, and this one cannot know whether it is one: with no store and no allowlist, the program's only input is source the model wrote, and opting down to `CONTAINER` weighs model-written code against a shared kernel. **With a store the program also reads whatever those files contain, and with an allowlist whatever an allowed host returns** — so the floor should be chosen against the provenance of everything the program can read, not against this kind's defaults. Only the host knows that.
 
+## Upgrading to 0.7
+
+`0.7.0` requires `maf-sandbox` 0.19, which made the egress mode a thing a workload declares.
+
+**`codeact_sandbox_spec`'s signature is unchanged** — there is no `egress` parameter to pass, because the mode follows from what you already say: name hosts in `egress_allow` and the spec runs in `Egress.ALLOWLIST`, name none and it runs in `Egress.CLOSED`. Nothing to edit.
+
+**What changed is what the router does with it.** A backend that cannot enforce the resulting mode is refused at attach rather than permitted with a warning, so a host that wired an allowlist against a backend confining everything used to get a program that failed at the fetch and now gets:
+
+```
+SandboxEgressNotEnforced: sandbox backend 'docker' cannot enforce the 'allowlist'
+egress the 'codeact' workload runs in (it enforces closed).
+```
+
+Give the backend a mode it can enforce — for `maf-sandbox-docker`, configure `egress_proxy_image` — or drop `egress_allow` and let the program run closed. The refusal is deliberate: a program that silently could not reach what its host meant to allow is the failure this replaces.
+
 ## Upgrading to 0.3
 
 `0.3.0` follows `maf-sandbox` 0.11, which retired the word `workspace` from the vocabulary. It requires that release.
@@ -115,7 +130,7 @@ Naming a host is a real widening, and worth naming as such: this sandbox runs mo
 
 ## What this version is not
 
-The `RUN_CODE` road served by an embedded-interpreter backend is absent on purpose — this kind only ever asks for `EXEC`. Host-tool dispatch is wired (`host_tools`, above), two shipped backends serve it, and what it costs has been measured: [`samples/15_acas_codeact_host_tools`](https://github.com/sokolaidev/maf-extensions/tree/main/samples/15_acas_codeact_host_tools) walks a four-stage lookup on ACAS twice, once dispatched and once through the model's own tool loop, and publishes both against wall clock and tokens ([#302](https://github.com/sokolaidev/maf-extensions/issues/302)). The short version: a dispatch is a serial round trip of about a second. On the run that sample documents it walked the stages in three tool-calling rounds against the direct route's five, and none of the twelve sales figures were written into a call the model made — what comes back to it is the program's finished table. The design that governs capabilities — declared by backends, required by specs, and what `HOST_TOOLS` carries — is [`docs/design/two-axis-sandbox-policy.md`](https://github.com/sokolaidev/maf-extensions/blob/main/docs/design/two-axis-sandbox-policy.md); the file channels above are specified in [`docs/design/files-out.md`](https://github.com/sokolaidev/maf-extensions/blob/main/docs/design/files-out.md).
+The `RUN_CODE` road served by an embedded-interpreter backend is absent on purpose — this kind only ever asks for `EXEC`. Host-tool dispatch is wired (`host_tools`, above), two shipped backends serve it, and what it costs has been measured: [`samples/15_acas_codeact_host_tools`](https://github.com/sokolaidev/maf-extensions/tree/main/samples/15_acas_codeact_host_tools) walks a four-stage lookup on ACAS twice, once dispatched and once through the model's own tool loop, and publishes both against wall clock and tokens ([#302](https://github.com/sokolaidev/maf-extensions/issues/302)). The short version: a dispatch is a serial round trip of about a second. On the run that sample documents it walked the stages in three tool-calling rounds against the direct route's five, and none of the twelve sales figures were written into a call the model made — what comes back to it is the program's finished table. The design that governs capabilities — declared by backends, required by specs, and what `HOST_TOOLS` carries — is [`docs/sandbox/capabilities.md`](https://github.com/sokolaidev/maf-extensions/blob/main/docs/sandbox/capabilities.md), which specifies the file channels above as well; where an artifact lands, and what a dispatched host tool may do, is [`docs/sandbox/hosts.md`](https://github.com/sokolaidev/maf-extensions/blob/main/docs/sandbox/hosts.md).
 
 The sandbox protocol's delete surface is capability-gated, and this kind does not require `FILES_DELETE`. It therefore uses a fresh directory per call for staleness isolation, while the framework reclaims that directory, and everything under it, when the call returns. A program that walks upwards can still open files outside its own directory during the call. The fresh directory removes staleness from the *namespace*, so a program reading `data.csv` gets this call's or nothing. Everything reachable that way belongs to the same conversation and the same agent, since that is what a sandbox is keyed by.
 

{maf_sandbox_codeact-0.7.0 → maf_sandbox_codeact-0.7.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "maf-sandbox-codeact"
-version = "0.7.0"
+version = "0.7.2"
 description = "CodeAct as a Microsoft Agent Framework tool — the model writes a short Python program and it runs inside a sandbox — written against maf-sandbox so it runs on any sandbox backend."
 readme = "README.md"
 requires-python = ">=3.12,<3.15"
@@ -24,7 +24,7 @@ classifiers = [
     "Topic :: Software Development :: Interpreters",
 ]
 dependencies = [
-    "maf-sandbox>=0.19.0,<0.21",
+    "maf-sandbox>=0.20.0,<0.22",
     "agent-framework-core>=1.13.0,<2",
 ]
 

{maf_sandbox_codeact-0.7.0 → maf_sandbox_codeact-0.7.2}/pyproject.toml.orig

@@ -1,6 +1,6 @@
 [project]
 name = "maf-sandbox-codeact"
-version = "0.7.0"
+version = "0.7.2"
 description = "CodeAct as a Microsoft Agent Framework tool — the model writes a short Python program and it runs inside a sandbox — written against maf-sandbox so it runs on any sandbox backend."
 readme = "README.md"
 requires-python = ">=3.12,<3.15"
@@ -34,7 +34,7 @@ dependencies = [
     # published wheel resolves a maf-sandbox base missing those imports. The number itself is
     # below, and `scripts/set_dependents_range.py` moves it — so this says which release the
     # floor is for, never which release that is.
-    "maf-sandbox>=0.19.0,<0.21",
+    "maf-sandbox>=0.20.0,<0.22",
     # The `@tool` decorator. MAF is a genuine dependency of the tool itself, not of the host
     # application.
     "agent-framework-core>=1.13.0,<2",