pactown 0.1.4__py3-none-any.whl → 0.1.47__py3-none-any.whl

pactown/sandbox_manager.py

@@ -1,20 +1,143 @@
 """Sandbox manager for pactown services."""
 
+import json
+import logging
 import os
+import re
 import shutil
+import stat
+import signal
 import subprocess
+import time
+import socket
 from concurrent.futures import ThreadPoolExecutor, as_completed
 from dataclasses import dataclass, field
+from datetime import datetime, UTC
 from pathlib import Path
-from typing import Optional, Any, Callable
-import signal
-import time
 from threading import Lock
+from typing import Callable, Optional, List, Dict, Any
 
-from markpact import Sandbox, parse_blocks, run_cmd, ensure_venv
+from markpact import Sandbox, ensure_venv
 from markpact.runner import install_deps
 
 from .config import ServiceConfig
+from .markpact_blocks import parse_blocks
+
+# Configure detailed logging
+logger = logging.getLogger("pactown.sandbox")
+logger.setLevel(logging.DEBUG)
+
+# File handler for persistent logs
+LOG_DIR = Path("/tmp/pactown-logs")
+LOG_DIR.mkdir(parents=True, exist_ok=True)
+_log_path = str(LOG_DIR / "sandbox.log")
+if not any(
+    isinstance(h, logging.FileHandler) and getattr(h, "baseFilename", None) == _log_path
+    for h in logger.handlers
+):
+    file_handler = logging.FileHandler(_log_path)
+    file_handler.setFormatter(logging.Formatter(
+        '%(asctime)s [%(levelname)s] %(name)s: %(message)s'
+    ))
+    logger.addHandler(file_handler)
+
+
+def _path_debug(path: Path) -> str:
+    try:
+        st = path.stat() if path.exists() else None
+        mode = oct(st.st_mode & 0o777) if st else "-"
+        uid = st.st_uid if st else "-"
+        gid = st.st_gid if st else "-"
+    except Exception:
+        mode, uid, gid = "?", "?", "?"
+    try:
+        readable = os.access(path, os.R_OK)
+        writable = os.access(path, os.W_OK)
+        executable = os.access(path, os.X_OK)
+    except Exception:
+        readable, writable, executable = False, False, False
+    return (
+        f"path={path} exists={path.exists()} is_dir={path.is_dir()} is_file={path.is_file()} "
+        f"mode={mode} uid={uid} gid={gid} access=r{int(readable)}w{int(writable)}x{int(executable)}"
+    )
+
+
+def _escape_dotenv_value(value: str) -> str:
+    v = str(value)
+    v = v.replace("\\", "\\\\")
+    v = v.replace("\n", "\\n")
+    v = v.replace("\r", "\\r")
+    v = v.replace('"', '\\"')
+    return f'"{v}"'
+
+
+def _write_dotenv_file(sandbox_path: Path, env: dict[str, str]) -> None:
+    lines: list[str] = []
+    for key, value in (env or {}).items():
+        if value is None:
+            continue
+        if not isinstance(key, str):
+            continue
+        if not re.match(r"^[A-Za-z_][A-Za-z0-9_]*$", key):
+            continue
+        lines.append(f"{key}={_escape_dotenv_value(str(value))}")
+
+    dotenv_path = sandbox_path / ".env"
+    dotenv_path.write_text("\n".join(lines) + ("\n" if lines else ""))
+    try:
+        dotenv_path.chmod(0o600)
+    except Exception:
+        pass
+
+
+def _sandbox_fallback_ids() -> tuple[int, int]:
+    try:
+        uid = int(os.environ.get("PACTOWN_SANDBOX_UID", "65534"))
+    except Exception:
+        uid = 65534
+    try:
+        gid = int(os.environ.get("PACTOWN_SANDBOX_GID", str(uid)))
+    except Exception:
+        gid = uid
+    return uid, gid
+
+
+def _chown_sandbox_tree(sandbox_path: Path, uid: int, gid: int) -> None:
+    try:
+        os.chown(sandbox_path, uid, gid)
+    except Exception:
+        pass
+    try:
+        sandbox_path.chmod(0o700)
+    except Exception:
+        pass
+
+    for root, dirnames, filenames in os.walk(sandbox_path):
+        if ".venv" in dirnames:
+            dirnames.remove(".venv")
+
+        root_path = Path(root)
+        try:
+            os.chown(root_path, uid, gid)
+        except Exception:
+            pass
+        try:
+            root_path.chmod(0o700)
+        except Exception:
+            pass
+
+        for name in filenames:
+            p = root_path / name
+            try:
+                st = os.lstat(p)
+                if stat.S_ISLNK(st.st_mode):
+                    continue
+            except Exception:
+                continue
+            try:
+                os.chown(p, uid, gid)
+            except Exception:
+                pass
 
 
 @dataclass
@@ -26,13 +149,19 @@ class ServiceProcess:
     sandbox_path: Path
     process: Optional[subprocess.Popen] = None
     started_at: float = field(default_factory=time.time)
-    
+
     @property
     def is_running(self) -> bool:
         if self.process:
             return self.process.poll() is None
         try:
             os.kill(self.pid, 0)
+            if self.port:
+                try:
+                    with socket.create_connection(("127.0.0.1", int(self.port)), timeout=0.2):
+                        return True
+                except OSError:
+                    return False
             return True
         except OSError:
             return False
@@ -40,95 +169,339 @@ class ServiceProcess:
 
 class SandboxManager:
     """Manages sandboxes for multiple services."""
-    
+
     def __init__(self, sandbox_root: str | Path):
         self.sandbox_root = Path(sandbox_root)
         self.sandbox_root.mkdir(parents=True, exist_ok=True)
         self._processes: dict[str, ServiceProcess] = {}
-    
+
     def get_sandbox_path(self, service_name: str) -> Path:
         """Get sandbox path for a service."""
         return self.sandbox_root / service_name
-    
-    def create_sandbox(self, service: ServiceConfig, readme_path: Path) -> Sandbox:
+
+    def create_sandbox(
+        self,
+        service: ServiceConfig,
+        readme_path: Path,
+        install_dependencies: bool = True,
+        on_log: Optional[Callable[[str], None]] = None,
+    ) -> Sandbox:
         """Create a sandbox for a service from its README."""
+        def dbg(msg: str, level: str = "DEBUG"):
+            if on_log:
+                on_log(msg)
+            else:
+                logger.log(getattr(logging, level), f"[{service.name}] {msg}")
+
         sandbox_path = self.get_sandbox_path(service.name)
-        
+
+        dbg(f"Sandbox root: {_path_debug(self.sandbox_root)}", "DEBUG")
+        dbg(f"Sandbox path: {_path_debug(sandbox_path)}", "DEBUG")
+        dbg(f"README path: {_path_debug(readme_path)}", "DEBUG")
+        dbg(f"UID/EUID/GID: uid={os.getuid()} euid={os.geteuid()} gid={os.getgid()}", "DEBUG")
+
         if sandbox_path.exists():
+            dbg(f"Removing existing sandbox: {sandbox_path}", "INFO")
             shutil.rmtree(sandbox_path)
-        sandbox_path.mkdir(parents=True)
-        
+        sandbox_path.mkdir(parents=True, exist_ok=False)
+        dbg(f"Created sandbox dir: {_path_debug(sandbox_path)}", "DEBUG")
+
         sandbox = Sandbox(sandbox_path)
-        
+
         readme_content = readme_path.read_text()
+        dbg(f"Read README bytes={len(readme_content.encode('utf-8', errors='replace'))}", "DEBUG")
         blocks = parse_blocks(readme_content)
-        
-        deps = []
-        run_command = None
-        
+
+        kind_counts: dict[str, int] = {}
+        for b in blocks:
+            kind_counts[b.kind] = kind_counts.get(b.kind, 0) + 1
+        dbg(f"Parsed markpact blocks: total={len(blocks)} kinds={kind_counts}", "DEBUG")
+
+        deps: list[str] = []
+
         for block in blocks:
             if block.kind == "deps":
                 deps.extend(block.body.strip().split("\n"))
             elif block.kind == "file":
                 file_path = block.get_path() or "main.py"
+                dbg(f"Writing file: {file_path} (chars={len(block.body)})", "DEBUG")
                 sandbox.write_file(file_path, block.body)
             elif block.kind == "run":
-                run_command = block.body.strip()
-        
-        if deps:
-            ensure_venv(sandbox, verbose=False)
-            install_deps([d for d in deps if d.strip()], sandbox, verbose=False)
-        
+                block.body.strip()
+
+        deps_clean = [d.strip() for d in deps if d.strip()]
+        if deps_clean:
+            # Always write requirements.txt so the sandbox can be used as a container build context
+            dbg(f"Dependencies detected: count={len(deps_clean)}", "INFO")
+            sandbox.write_requirements(deps_clean)
+            dbg(f"Wrote requirements.txt: {_path_debug(sandbox.path / 'requirements.txt')}", "DEBUG")
+
+            if install_dependencies:
+                dbg(f"Creating venv (.venv) in sandbox", "INFO")
+                try:
+                    ensure_venv(sandbox, verbose=False)
+                    dbg(f"Venv status: {_path_debug(sandbox.path / '.venv')}", "DEBUG")
+                except Exception as e:
+                    dbg(f"ensure_venv failed: {e}", "ERROR")
+                    raise
+                dbg("Installing dependencies via pip", "INFO")
+                try:
+                    install_deps(deps_clean, sandbox, verbose=False)
+                    dbg("Dependencies installed", "INFO")
+                except Exception as e:
+                    dbg(f"install_deps failed: {e}", "ERROR")
+                    raise
+        else:
+            dbg("No dependencies block found", "DEBUG")
+
         return sandbox
-    
+
     def start_service(
         self,
         service: ServiceConfig,
         readme_path: Path,
         env: dict[str, str],
         verbose: bool = True,
+        restart_if_running: bool = False,
+        on_log: Optional[Callable[[str], None]] = None,
+        user_id: Optional[str] = None,
     ) -> ServiceProcess:
-        """Start a service in its sandbox."""
+        """Start a service in its sandbox.
+        
+        Args:
+            service: Service configuration
+            readme_path: Path to README.md with markpact blocks
+            env: Environment variables to pass to the service
+            verbose: Print status messages
+            restart_if_running: If True, stop and restart if already running
+            on_log: Callback for detailed logging
+            user_id: Optional SaaS user ID for process isolation
+        """
+        def log(msg: str, level: str = "INFO"):
+            logger.log(getattr(logging, level), f"[{service.name}] {msg}")
+            if on_log:
+                on_log(msg)
+            if verbose:
+                print(msg)
+        
+        log(f"Starting service: {service.name}", "INFO")
+        log(f"Port: {service.port}, README: {readme_path}", "DEBUG")
+        log(f"Runner UID/EUID/GID: uid={os.getuid()} euid={os.geteuid()} gid={os.getgid()}", "DEBUG")
+        log(f"Sandbox root: {_path_debug(self.sandbox_root)}", "DEBUG")
+        log(f"README: {_path_debug(readme_path)}", "DEBUG")
+        
         if service.name in self._processes:
             existing = self._processes[service.name]
             if existing.is_running:
-                raise RuntimeError(f"Service {service.name} is already running")
-        
-        sandbox = self.create_sandbox(service, readme_path)
-        
+                if restart_if_running:
+                    log(f"Restarting {service.name}...", "INFO")
+                    self.stop_service(service.name)
+                    self.clean_sandbox(service.name)
+                else:
+                    log(f"Service {service.name} already running", "ERROR")
+                    raise RuntimeError(f"Service {service.name} is already running")
+
+        # Create sandbox with dependency installation
+        log("Creating sandbox and installing dependencies...", "INFO")
+        try:
+            sandbox = self.create_sandbox(
+                service,
+                readme_path,
+                install_dependencies=True,
+                on_log=log,
+            )
+            log(f"Sandbox created at: {sandbox.path}", "INFO")
+        except Exception as e:
+            log(f"Failed to create sandbox: {e}", "ERROR")
+            logger.exception(f"Sandbox creation failed for {service.name}")
+            raise
+
         readme_content = readme_path.read_text()
         blocks = parse_blocks(readme_content)
-        
+
         run_command = None
         for block in blocks:
             if block.kind == "run":
                 run_command = block.body.strip()
                 break
-        
+
         if not run_command:
+            log(f"No run command found in README", "ERROR")
             raise ValueError(f"No run command found in {readme_path}")
-        
+
+        log(f"Run command: {run_command}", "DEBUG")
+
         full_env = os.environ.copy()
         full_env.update(env)
         
-        if sandbox.has_venv:
+        # Ensure PORT is always set in environment
+        full_env["PORT"] = str(service.port)
+        full_env["MARKPACT_PORT"] = str(service.port)
+
+        dotenv_env = dict(env or {})
+        dotenv_env["PORT"] = str(service.port)
+        dotenv_env["MARKPACT_PORT"] = str(service.port)
+        _write_dotenv_file(sandbox.path, dotenv_env)
+
+        if sandbox.has_venv():
             venv_bin = str(sandbox.venv_bin)
             full_env["PATH"] = f"{venv_bin}:{full_env.get('PATH', '')}"
             full_env["VIRTUAL_ENV"] = str(sandbox.path / ".venv")
+            log(f"Using venv: {sandbox.path / '.venv'}", "DEBUG")
+        else:
+            log("WARNING: No venv found, using system Python", "WARNING")
+
+        # Expand $PORT in command
+        expanded_cmd = run_command.replace("$PORT", str(service.port))
+        expanded_cmd = expanded_cmd.replace("${PORT}", str(service.port))
+        expanded_cmd = expanded_cmd.replace("${MARKPACT_PORT}", str(service.port))
+        expanded_cmd = expanded_cmd.replace("$MARKPACT_PORT", str(service.port))
+        
+        # Replace hardcoded ports in run command with the requested port
+        # This handles cases where LLM generates hardcoded ports like --port 8000
+        import re
+        port_patterns = [
+            (r'--port[=\s]+(\d+)', f'--port {service.port}'),  # --port 8000 or --port=8000
+            (r'-p[=\s]+(\d+)', f'-p {service.port}'),          # -p 8000 or -p=8000
+            (r':(\d{4,5})(?=\s|$|")', f':{service.port}'),     # :8000 at end of string
+        ]
         
-        if verbose:
-            print(f"Starting {service.name} on port {service.port}...")
-        
+        original_cmd = expanded_cmd
+        for pattern, replacement in port_patterns:
+            match = re.search(pattern, expanded_cmd)
+            if match:
+                old_port = match.group(1) if match.groups() else None
+                if old_port and old_port != str(service.port):
+                    log(f"Replacing hardcoded port {old_port} with {service.port}", "INFO")
+                    expanded_cmd = re.sub(pattern, replacement, expanded_cmd)
+        
+        if expanded_cmd != original_cmd:
+            log(f"Port-corrected command: {expanded_cmd}", "INFO")
+        else:
+            log(f"Expanded command: {expanded_cmd}", "DEBUG")
+        
+        # Remove --reload flag from uvicorn commands in sandbox environments
+        # --reload uses multiprocessing which can crash in Docker containers
+        if "--reload" in expanded_cmd and "uvicorn" in expanded_cmd:
+            expanded_cmd = re.sub(r'\s*--reload\s*', ' ', expanded_cmd)
+            log(f"Removed --reload flag (not compatible with sandbox): {expanded_cmd}", "INFO")
+
+        log(f"Starting process...", "INFO")
+
+        # Use user isolation if user_id provided
+        preexec = os.setsid
+        if user_id:
+            try:
+                from .user_isolation import get_isolation_manager
+                isolation = get_isolation_manager()
+                try:
+                    can_isolate, reason = isolation.can_isolate()
+                    log(f"Isolation capability: can_isolate={can_isolate} reason={reason}", "DEBUG")
+                except Exception as e:
+                    log(f"Isolation capability check failed: {e}", "WARNING")
+                user = isolation.get_or_create_user(user_id)
+                log(f"🔒 Running as isolated user: {user.linux_username} (uid={user.linux_uid})", "INFO")
+                
+                # Update env with user-specific settings
+                full_env["HOME"] = str(user.home_dir)
+                full_env["USER"] = user.linux_username
+                full_env["LOGNAME"] = user.linux_username
+                
+                # Create preexec function for user switching
+                def preexec():
+                    os.setsid()
+                    if os.geteuid() == 0:
+                        os.setgid(user.linux_gid)
+                        os.setuid(user.linux_uid)
+            except Exception as e:
+                log(f"⚠️ User isolation not available: {e} - using sandbox uid", "WARNING")
+                if os.geteuid() == 0:
+                    uid, gid = _sandbox_fallback_ids()
+                    log(f"Sandbox uid fallback: uid={uid} gid={gid}", "DEBUG")
+                    try:
+                        dotenv_path = sandbox.path / ".env"
+                        if dotenv_path.exists():
+                            os.chown(dotenv_path, uid, gid)
+                    except Exception:
+                        pass
+                    _chown_sandbox_tree(sandbox.path, uid, gid)
+
+                    def preexec():
+                        os.setsid()
+                        os.setgid(gid)
+                        os.setuid(uid)
+
+        # Always capture stderr for debugging
         process = subprocess.Popen(
-            run_command,
+            expanded_cmd,
             shell=True,
             cwd=str(sandbox.path),
             env=full_env,
-            stdout=subprocess.PIPE if not verbose else None,
-            stderr=subprocess.PIPE if not verbose else None,
-            preexec_fn=os.setsid,
+            stdout=subprocess.PIPE,
+            stderr=subprocess.PIPE,
+            preexec_fn=preexec,
         )
-        
+
+        log(f"Process started with PID: {process.pid}", "INFO")
+
+        # Wait briefly for process to start (but don't block too long)
+        time.sleep(0.2)
+        
+        # Check if process died immediately
+        poll_result = process.poll()
+        if poll_result is not None:
+            # Process already died - capture all output
+            exit_code = poll_result
+            stderr = ""
+            stdout = ""
+            
+            try:
+                # Read all output with timeout
+                stdout_bytes, stderr_bytes = process.communicate(timeout=2)
+                stderr = stderr_bytes.decode('utf-8', errors='replace') if stderr_bytes else ""
+                stdout = stdout_bytes.decode('utf-8', errors='replace') if stdout_bytes else ""
+            except Exception as e:
+                log(f"Could not read process output: {e}", "WARNING")
+                if process.stderr:
+                    try:
+                        stderr = process.stderr.read().decode('utf-8', errors='replace')
+                    except:
+                        pass
+            
+            # Interpret exit code
+            if exit_code < 0:
+                signal_name = {
+                    -9: "SIGKILL",
+                    -15: "SIGTERM", 
+                    -11: "SIGSEGV",
+                    -6: "SIGABRT",
+                }.get(exit_code, f"signal {-exit_code}")
+                log(f"Process killed by {signal_name} (exit code: {exit_code})", "ERROR")
+            else:
+                log(f"Process exited with code: {exit_code}", "ERROR")
+            
+            if stderr:
+                log(f"STDERR:\n{stderr[:2000]}", "ERROR")
+            if stdout:
+                log(f"STDOUT:\n{stdout[:1000]}", "DEBUG")
+            
+            # Write to error log file
+            error_log = LOG_DIR / f"{service.name}_error.log"
+            with open(error_log, "w") as f:
+                f.write(f"Exit code: {exit_code}\n")
+                f.write(f"Command: {expanded_cmd}\n")
+                f.write(f"CWD: {sandbox.path}\n")
+                f.write(f"Venv: {sandbox.path / '.venv'}\n")
+                f.write(f"\n--- STDERR ---\n{stderr}\n")
+                f.write(f"\n--- STDOUT ---\n{stdout}\n")
+                # List files for debugging
+                try:
+                    files = list(sandbox.path.glob("*"))
+                    f.write(f"\n--- FILES ---\n{[str(f) for f in files]}\n")
+                except:
+                    pass
+            log(f"Error log written to: {error_log}", "DEBUG")
+
         svc_process = ServiceProcess(
             name=service.name,
             pid=process.pid,
@@ -136,52 +509,80 @@ class SandboxManager:
             sandbox_path=sandbox.path,
             process=process,
         )
-        
+
         self._processes[service.name] = svc_process
+        
+        # Log sandbox contents for debugging
+        try:
+            files = list(sandbox.path.glob("*"))
+            log(f"Sandbox files: {[f.name for f in files]}", "DEBUG")
+        except:
+            pass
+        
         return svc_process
-    
+
     def stop_service(self, service_name: str, timeout: int = 10) -> bool:
         """Stop a running service."""
         if service_name not in self._processes:
+            logger.debug(f"Service {service_name} not in tracked processes")
             return False
-        
+
         svc = self._processes[service_name]
-        
+        old_pid = svc.pid
+
         if not svc.is_running:
+            logger.debug(f"Service {service_name} (PID {old_pid}) already stopped")
             del self._processes[service_name]
             return True
+
+        logger.info(f"Stopping service {service_name} (PID {old_pid})")
         
         try:
-            os.killpg(os.getpgid(svc.pid), signal.SIGTERM)
+            pgid = os.getpgid(old_pid)
+            os.killpg(pgid, signal.SIGTERM)
+            logger.debug(f"Sent SIGTERM to process group {pgid}")
         except ProcessLookupError:
+            logger.debug(f"Process {old_pid} already gone")
             del self._processes[service_name]
             return True
-        
+        except OSError as e:
+            logger.warning(f"Error getting pgid for {old_pid}: {e}")
+            # Try killing just the process
+            try:
+                os.kill(old_pid, signal.SIGTERM)
+            except ProcessLookupError:
+                pass
+
         deadline = time.time() + timeout
         while time.time() < deadline:
             if not svc.is_running:
                 break
             time.sleep(0.1)
-        
+
         if svc.is_running:
+            logger.warning(f"Service {service_name} didn't stop gracefully, sending SIGKILL")
             try:
-                os.killpg(os.getpgid(svc.pid), signal.SIGKILL)
-            except ProcessLookupError:
+                os.killpg(os.getpgid(old_pid), signal.SIGKILL)
+            except (ProcessLookupError, OSError):
                 pass
-        
+
         del self._processes[service_name]
+        
+        # Wait for OS to clean up the process
+        time.sleep(0.3)
+        logger.info(f"Service {service_name} stopped")
         return True
-    
+
     def stop_all(self, timeout: int = 10) -> None:
         """Stop all running services."""
         for name in list(self._processes.keys()):
             self.stop_service(name, timeout)
-    
+
     def get_status(self, service_name: str) -> Optional[dict]:
         """Get status of a service."""
         if service_name not in self._processes:
             return None
-        
+
         svc = self._processes[service_name]
         return {
             "name": svc.name,
@@ -191,7 +592,7 @@ class SandboxManager:
             "uptime": time.time() - svc.started_at,
             "sandbox": str(svc.sandbox_path),
         }
-    
+
     def get_all_status(self) -> list[dict]:
         """Get status of all services."""
         return [
@@ -199,19 +600,19 @@ class SandboxManager:
             for name in self._processes
             if self.get_status(name)
         ]
-    
+
     def clean_sandbox(self, service_name: str) -> None:
         """Remove sandbox directory for a service."""
         sandbox_path = self.get_sandbox_path(service_name)
         if sandbox_path.exists():
             shutil.rmtree(sandbox_path)
-    
+
     def clean_all(self) -> None:
         """Remove all sandbox directories."""
         if self.sandbox_root.exists():
             shutil.rmtree(self.sandbox_root)
         self.sandbox_root.mkdir(parents=True)
-    
+
     def create_sandboxes_parallel(
         self,
         services: list[tuple[ServiceConfig, Path]],
@@ -220,36 +621,36 @@ class SandboxManager:
     ) -> dict[str, Sandbox]:
         """
         Create sandboxes for multiple services in parallel.
-        
+
         Args:
             services: List of (ServiceConfig, readme_path) tuples
             max_workers: Maximum parallel workers
             on_complete: Callback(name, success, duration)
-        
+
         Returns:
             Dict of {service_name: Sandbox}
         """
         results: dict[str, Sandbox] = {}
         errors: dict[str, str] = {}
         lock = Lock()
-        
+
         def create_one(service: ServiceConfig, readme_path: Path) -> tuple[str, Sandbox]:
             sandbox = self.create_sandbox(service, readme_path)
             return service.name, sandbox
-        
+
         with ThreadPoolExecutor(max_workers=max_workers) as executor:
             futures = {}
             start_times = {}
-            
+
             for service, readme_path in services:
                 start_times[service.name] = time.time()
                 future = executor.submit(create_one, service, readme_path)
                 futures[future] = service.name
-            
+
             for future in as_completed(futures):
                 name = futures[future]
                 duration = time.time() - start_times[name]
-                
+
                 try:
                     _, sandbox = future.result()
                     with lock:
@@ -261,13 +662,13 @@ class SandboxManager:
                         errors[name] = str(e)
                     if on_complete:
                         on_complete(name, False, duration)
-        
+
         if errors:
             error_msg = "; ".join(f"{k}: {v}" for k, v in errors.items())
             raise RuntimeError(f"Failed to create sandboxes: {error_msg}")
-        
+
         return results
-    
+
     def start_services_parallel(
         self,
         services: list[tuple[ServiceConfig, Path, dict[str, str]]],
@@ -276,43 +677,43 @@ class SandboxManager:
     ) -> dict[str, ServiceProcess]:
         """
         Start multiple services in parallel.
-        
+
         Note: Should only be used for services with no inter-dependencies.
         For dependent services, use the orchestrator's wave-based approach.
-        
+
         Args:
             services: List of (ServiceConfig, readme_path, env) tuples
             max_workers: Maximum parallel workers
             on_complete: Callback(name, success, duration)
-        
+
         Returns:
             Dict of {service_name: ServiceProcess}
         """
         results: dict[str, ServiceProcess] = {}
         errors: dict[str, str] = {}
         lock = Lock()
-        
+
         def start_one(
-            service: ServiceConfig, 
-            readme_path: Path, 
+            service: ServiceConfig,
+            readme_path: Path,
             env: dict[str, str]
         ) -> tuple[str, ServiceProcess]:
             proc = self.start_service(service, readme_path, env, verbose=False)
             return service.name, proc
-        
+
         with ThreadPoolExecutor(max_workers=max_workers) as executor:
             futures = {}
             start_times = {}
-            
+
             for service, readme_path, env in services:
                 start_times[service.name] = time.time()
                 future = executor.submit(start_one, service, readme_path, env)
                 futures[future] = service.name
-            
+
             for future in as_completed(futures):
                 name = futures[future]
                 duration = time.time() - start_times[name]
-                
+
                 try:
                     _, proc = future.result()
                     with lock:
@@ -324,5 +725,5 @@ class SandboxManager:
                         errors[name] = str(e)
                     if on_complete:
                         on_complete(name, False, duration)
-        
+
         return results, errors