sandboxa 0.1.0__tar.gz

sandboxa-0.1.0/.bumpversion.cfg

@@ -0,0 +1,12 @@
+[bumpversion]
+current_version = 0.1.0
+tag = True
+commit = True
+
+[bumpversion:file:VERSION]
+
+[bumpversion:file:pyproject.toml]
+
+[bumpversion:file:sandboxa/__init__.py]
+search = VERSION = "{current_version}"
+replace = VERSION = "{new_version}"

sandboxa-0.1.0/.flake8

@@ -0,0 +1,2 @@
+[flake8]
+max-line-length = 88

sandboxa-0.1.0/.gitignore

@@ -0,0 +1,3 @@
+.*.sw[op]
+__pycache__/
+/session-ses_*.md

sandboxa-0.1.0/.gitlab-ci.yml

@@ -0,0 +1,54 @@
+image: debian:trixie-slim
+variables:
+  PIPX_BIN_DIR: /usr/local/bin
+
+stages:
+  - lint
+  - test
+  - build
+  - smoke
+
+default:
+  before_script:
+    - apt-get update
+    - apt-get install --yes --no-install-recommends ca-certificates just pipx python3 python3-build python3-flake8 python3-hatchling python3-pip python3-venv
+    - pipx install --global hatch
+
+lint:
+  stage: lint
+  script:
+    - just lint
+
+test:
+  stage: test
+  script:
+    - just test
+
+build:
+  stage: build
+  script:
+    - just build
+  artifacts:
+    paths:
+      - dist/*.whl
+      - dist/*.tar.gz
+    expire_in: 1 week
+
+build-tagged:
+  extends: build
+  rules:
+    - if: $CI_COMMIT_TAG
+  artifacts:
+    paths:
+      - dist/*.whl
+      - dist/*.tar.gz
+    expire_in: never
+
+smoke:
+  stage: smoke
+  needs:
+    - job: build
+      artifacts: true
+  script:
+    - python3 -m pip install --break-system-packages dist/*.whl
+    - sandboxa --version

sandboxa-0.1.0/.sandboxa.yaml

@@ -0,0 +1,10 @@
+allow_settings:
+  - opencode
+
+extra_data_paths: []
+
+excluded_paths:
+  - build/
+  - secrets/
+
+refuse_if_exists: .profile

sandboxa-0.1.0/AGENTS.md

@@ -0,0 +1,26 @@
+# AGENTS
+
+## Repository shape
+- This repo is a tiny single-package utility: main logic is in `sandboxa/__main__.py`.
+- User config is read from `~/.config/sandboxa.yaml`; project-local config is read from `.sandboxa.yaml` (or `--config-file` override).
+
+## Core behavior to preserve
+- `sandboxa` launches `systemd-run --user --pty` with strict isolation (`ProtectHome=tmpfs`, `PrivateTmp=true`, `PrivateDevices=true`).
+- It binds the chosen project path and optional `--extra-data-path` mounts; OpenCode state/config/cache paths are additionally bound only when `allow_settings` includes `opencode` in project-local `.sandboxa.yaml`.
+- It refuses to run if `"$PROJECT_PATH/.profile"` exists; keep this guard unless intentionally changing the safety model.
+
+## Invocation and env contract
+- Default command is `opencode`; override with first positional `RUN_COMMAND`.
+- Target directory is set with `--project-path` (defaults to current working directory).
+- Extra bind mounts are passed via repeated `--extra-data-path` options (or `extra_data_paths` in project-local YAML).
+- Exclusions are passed via repeated `--excluded-path` options (or `excluded_paths` in project-local YAML); absolute/out-of-project entries fail, and non-existing paths are ignored.
+- YAML config supports `allow_settings`, `extra_data_paths`, `excluded_paths`, and `refuse_if_exists`; project YAML overrides user YAML except `allow_settings` and `excluded_paths` which are merged; CLI args take precedence over YAML values.
+- `--config-file` accepts an absolute path or a project-relative filename.
+- `--no-reconnect` skip reusing an existing session (e.g. OpenCode) for the project directory
+- Use `--dry-run` to print the generated `systemd-run` command without executing.
+
+## Practical verification
+- Run `just lint` after edits.
+- Ensure `ruamel.yaml` and `pydantic` are installed before smoke tests.
+- Run `just test` for core behavior coverage.
+- Smoke test with `python3 -m sandboxa bash --project-path . -- -lc "echo smoke-ok"` to confirm argument handling and launch path.

sandboxa-0.1.0/CHANGELOG.md

@@ -0,0 +1,37 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+
+## ## [0.1.0] - 2026-06-02
+
+### Added
+- Python launcher script `sandboxa` to run commands in a restricted `systemd-run --user --pty` sandbox.
+- YAML configuration support via `.sandboxa.yaml`.
+- User-level configuration support from `~/.config/sandboxa.yaml`.
+- CLI options for project path, extra bind paths, excluded paths, reconnect control, and dry-run output.
+- `allow_settings` templates for `opencode`, `podman`, `ssh`, and `vim`.
+- SSH support that allows `~/.ssh`, optionally binds `SSH_AUTH_SOCK`, and forwards `SSH_AUTH_SOCK` into the sandbox environment.
+- Reconnect support for OpenCode sessions in the same project directory.
+- Test suite under `tests/` with `unittest`.
+- `just` targets for formatting, linting, and tests.
+- Flake8 configuration compatible with Black line wrapping.
+- `--version` output.
+- Simple release workflow via `just release patch|minor|major`.
+- `VERSION` file and `bumpversion` configuration for synchronized version bumps.
+- `LICENSE` file with GNU GPL v3 text.
+- Python package metadata for pip installation using Hatch.
+- CI workflow for GitLab
+
+### Security
+- Restricted `vim` template to `~/.vimrc` only (no `~/.vim` bind).
+- Excluded paths are validated to reject absolute/out-of-project entries.
+- Excluded paths that do not exist are ignored to avoid `systemd-run` failures.
+- Home-like project directories are refused by marker check (`.profile` by default).
+
+### Changed
+- Project license changed to GNU GPL v3 or later (`GPL-3.0-or-later`).
+- Added SPDX license headers to Python source files.

sandboxa-0.1.0/CONTRIBUTING.md

@@ -0,0 +1,7 @@
+# Release workflow
+
+1. Update `CHANGELOG.md` by moving relevant entries from `Unreleased` into a
+   new version section.
+1. Run the *just* target "release" with a version part, e.g. `just release minor`
+1. Push commit and tags manually: `git push && git push --tags`
+1. Upload to [pypi](https://pypi.org/): `just publish`