aaa.sandbox

Sandbox

Bases: Protocol

DockerSandbox

DockerSandbox(
    *,
    images: Mapping[str, str] | None = None,
    docker: str = "docker",
    user: str = "65534:65534",
    extra_args: Sequence[str] = (),
)

command

command(
    name: str, language: str, limits: Limits
) -> list[str]

The exact docker run invocation (exposed so the hardening can be asserted without Docker).

SubprocessSandbox

SubprocessSandbox(*, unsafe: bool = False)

Limits dataclass

Limits(
    timeout_s: float = 10.0,
    memory_mb: int = 256,
    cpus: float = 1.0,
    pids: int = 64,
    tmp_mb: int = 64,
    max_output_bytes: int = 100000,
    max_file_mb: int = 16,
)

ExecResult dataclass

ExecResult(
    exit_code: int | None,
    stdout: str = "",
    stderr: str = "",
    timed_out: bool = False,
    truncated: bool = False,
    killed: str | None = None,
    duration_s: float = 0.0,
)

code_exec_tool

code_exec_tool(
    sandbox: Sandbox,
    *,
    languages: tuple[str, ...] = ("python",),
    limits: Limits | None = None,
    requires_approval: bool = True,
    name: str = "code_exec",
) -> Tool

A tool that runs model-written code in sandbox. Every call waits for human approval by default (the engine's approval flow); turn that off only for a sandbox you would trust with the worst code the model could write.