tighten sandbox handles and template creds by steven-passynkov · Pull Request #10 · leap0-dev/leap0-python

steven-passynkov · 2026-04-02T17:54:38Z

Summary by CodeRabbit

Breaking Changes
- Sandbox-scoped services (filesystem, git, process, pty, lsp, ssh, code_interpreter, desktop) are no longer accessible directly on the client; use sandbox. instead.
New Features
- Strongly-typed registry credential models for Basic, AWS, GCP, and Azure; template creation now accepts these credential types.
- Introduced a nominal SandboxHandle type for sandbox references.
Documentation
- Examples updated to show using sandbox..
Bug Fixes
- Fixed module export/dir listing.

coderabbitai · 2026-04-02T17:54:53Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 43e1db24-af33-4809-831d-2c19e14f7177

📥 Commits

Reviewing files that changed from the base of the PR and between c5105f1 and 526c6d3.

📒 Files selected for processing (1)

pyproject.toml

✅ Files skipped from review due to trivial changes (1)

pyproject.toml

📝 Walkthrough

Walkthrough

Privatizes sandbox-scoped services on sync/async clients (moved to underscored attributes), adds a SandboxHandle type, rewires sandbox-bound proxies to use private client attrs, introduces typed registry credential models and union, updates TemplatesClient.create signatures, and adjusts tests and doc examples.

Changes

Cohort / File(s)	Summary
Package exports `leap0/__init__.py`	Adds exports and dynamic import mappings for `AwsRegistryCredentials`, `AzureRegistryCredentials`, `BasicRegistryCredentials`, `GcpRegistryCredentials`, `RegistryCredentials`, `RegistryCredentialsInput`; fixes an unreachable literal in `__dir__`.
Client privatization — Async `leap0/_async/client.py`, `leap0/_async/sandbox.py`, `tests/_async/test_client.py`, `tests/_async/test_sandboxes.py`	Moves sandbox services to underscored attrs on `AsyncLeap0Client`, adds `__getattr__` to direct callers to `sandbox.{name}`, updates `AsyncSandbox` to inherit `SandboxHandle` and bind to `client._*`; tests adjusted to expect/construct underscored attrs and assert AttributeError for `client.filesystem`.
Client privatization — Sync `leap0/_sync/client.py`, `leap0/_sync/sandbox.py`, `tests/_sync/test_sandboxes.py`, `tests/models/test_config.py`	Same changes for sync client: underscored sandbox service attrs, `__getattr__` guidance, `Sandbox` → `SandboxHandle` subclass, and tests/mocks updated to underscore-prefixed attrs and attribute-access assertions.
Sandbox nominal type `leap0/_internal/types.py`	Adds `SandboxHandle` class with `id: str` as a nominal base type for sandbox handles.
Sandbox models & id handling `leap0/models/sandbox.py`, `tests/models/test_sandbox.py`	`Sandbox` and `SandboxStatus` now inherit `SandboxHandle`; `SandboxRef` becomes `str
Registry credentials models `leap0/models/template.py`, `tests/models/test_template.py`, `tests/test_import.py`	Adds Pydantic models `BasicRegistryCredentials`, `AwsRegistryCredentials`, `GcpRegistryCredentials`, `AzureRegistryCredentials`, a discriminated union `RegistryCredentials`/`RegistryCredentialsInput`, updates `CreateTemplateParams.credentials` type and validator, switches payload dump to JSON mode; tests updated to assert concrete models and export availability.
Templates clients (sig change) `leap0/_sync/templates.py`, `leap0/_async/templates.py`	Broadens `create(..., credentials=...)` parameter to accept `RegistryCredentials
Docstring updates `leap0/_async/filesystem.py`, `leap0/_async/process.py`, `leap0/_sync/filesystem.py`, `leap0/_sync/process.py`, `leap0/_sync/code_interpreter.py`	Examples updated to call sandbox-scoped services via `sandbox.<service>` instead of `client.<service>`.
Project version `pyproject.toml`	Bumps package version from `0.3.0` to `0.3.1`.

Sequence Diagram(s)

sequenceDiagram
  rect rgba(66,133,244,0.5)
    participant Caller
  end
  rect rgba(15,157,88,0.5)
    participant Client
  end
  rect rgba(244,180,0,0.5)
    participant Sandbox
  end
  rect rgba(219,68,55,0.5)
    participant Service
  end

  Caller->>Client: access attribute "filesystem"
  alt attribute scoped to sandbox only
    Client->>Caller: AttributeError("use sandbox.filesystem")
  else Caller uses sandbox
    Caller->>Sandbox: sandbox.filesystem.method(...)
    Sandbox->>Client: access client._filesystem
    Client->>Service: perform operation
    Service-->>Client: result
    Client-->>Sandbox: return result
    Sandbox-->>Caller: return result
  end

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~45 minutes

Possibly related PRs

refactor async #7: Shares changes to template credential types and TemplatesClient.create signature expansions.

Poem

🐰 Hop hop, the services hide

Beneath an underscore tide,
SandboxHandle holds the key,
Typed credentials, tidy and free,
I nibble bugs and then I glide.

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 29.31% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'tighten sandbox handles and template creds' accurately summarizes the main changes: introducing SandboxHandle as a base type for sandbox references and expanding template credential type support with strongly-typed Pydantic models.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch tighten-sandbox-handles

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

coderabbitai

Actionable comments posted: 1

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

leap0/__init__.py (1)
337-337: ⚠️ Potential issue | 🔴 Critical

Orphaned code fragment at end of file.

Line 337 contains "GcpRegistryCredentialsDict", which appears to be a stray line outside any valid Python structure. This will cause a SyntaxError at module load time.
🐛 Proposed fix: remove the orphaned line
 def __dir__() -> list[str]:
     return sorted(__all__)
-    "GcpRegistryCredentialsDict",
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@leap0/__init__.py` at line 337, Remove the stray orphaned line containing the
bare string "GcpRegistryCredentialsDict" at the end of the module so the file is
syntactically valid; search for the symbol GcpRegistryCredentialsDict to ensure
it isn't accidentally duplicated and, if it should exist, reintroduce it
properly as part of a class, type alias, or __all__ list rather than as a
standalone string.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@tests/models/test_config.py`:
- Around line 55-56: The pytest assertion uses match="sandbox.filesystem" which
treats the dot as a regex wildcard; update the pytest.raises call (the one
asserting access to client.filesystem) to use an escaped regex so it matches the
literal text, e.g. change the match to a raw/escaped pattern like
r"sandbox\.filesystem" to ensure precise matching of the error message.

---

Outside diff comments:
In `@leap0/__init__.py`:
- Line 337: Remove the stray orphaned line containing the bare string
"GcpRegistryCredentialsDict" at the end of the module so the file is
syntactically valid; search for the symbol GcpRegistryCredentialsDict to ensure
it isn't accidentally duplicated and, if it should exist, reintroduce it
properly as part of a class, type alias, or __all__ list rather than as a
standalone string.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 0568d0d8-b366-412a-a8f8-4e56a41b9834

📥 Commits

Reviewing files that changed from the base of the PR and between ff19643 and 8a2ba56.

📒 Files selected for processing (22)

leap0/__init__.py
leap0/_async/client.py
leap0/_async/filesystem.py
leap0/_async/process.py
leap0/_async/sandbox.py
leap0/_async/templates.py
leap0/_internal/types.py
leap0/_sync/client.py
leap0/_sync/code_interpreter.py
leap0/_sync/filesystem.py
leap0/_sync/process.py
leap0/_sync/sandbox.py
leap0/_sync/templates.py
leap0/models/sandbox.py
leap0/models/template.py
tests/_async/test_client.py
tests/_async/test_sandboxes.py
tests/_sync/test_sandboxes.py
tests/models/test_config.py
tests/models/test_sandbox.py
tests/models/test_template.py
tests/test_import.py

tighten sandbox handles and template creds

8a2ba56

coderabbitai Bot reviewed Apr 2, 2026

View reviewed changes

Comment thread tests/models/test_config.py Outdated

steven-passynkov added 2 commits April 2, 2026 14:06

fix init export cleanup

c5105f1

bump version

526c6d3

steven-passynkov merged commit aabf3ae into main Apr 2, 2026
1 check passed

coderabbitai Bot mentioned this pull request Apr 6, 2026

Refactor #12

Merged

This was referenced Apr 13, 2026

Add sandbox and snapshot list APIs #14

Merged

Add presigned URL APIs #15

Merged

coderabbitai Bot mentioned this pull request Apr 22, 2026

add sandbox mounts #17

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

tighten sandbox handles and template creds#10

tighten sandbox handles and template creds#10
steven-passynkov merged 3 commits into
mainfrom
tighten-sandbox-handles

steven-passynkov commented Apr 2, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Apr 2, 2026 •

edited

Loading

Walkthrough

Changes

Sequence Diagram(s)

Estimated code review effort

Possibly related PRs

Poem

❌ Failed checks (1 warning)

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

steven-passynkov commented Apr 2, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Apr 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Sequence Diagram(s)

Estimated code review effort

Possibly related PRs

Poem

❌ Failed checks (1 warning)

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

steven-passynkov commented Apr 2, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Apr 2, 2026 •

edited

Loading