feat(sandboxes): add Python session and execution facade - #372
shawnwu-kong wants to merge 3 commits into
Conversation
|
@codex review |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2ca167225e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| def _sandbox_token(self) -> str: | ||
| session = self._capture_session()[1] |
There was a problem hiding this comment.
When a client has both a configured service_key and a current auth session, this branch always selects the auth user's access token. The project-level create/one-shot execution, lifecycle, and grant/revoke routes accept ServiceRoleKey or the separate opaque UserToken, not AuthUserAccessToken, so signing a user in causes previously working backend operations such as client.sandboxes.create(...) and grant(...) to start returning 401/403 despite the valid service key still being present. Credential selection needs to depend on the operation so only the session-scoped routes that explicitly permit granted auth users use session.access_token.
Useful? React with 👍 / 👎.
This branch has not been deployed
1 participant
Adds the Python Sandbox facade coordinated with Hosting P7 (#1354) and JavaScript SDK #270: one-shot commands, sessions, lifecycle operations, binary files, scoped HTTP access, and backend-managed user grants.
Uses generated operations from Hosting's bundled public OpenAPI. Preserves caller request IDs without replaying uncertain commands, omits named-template memory overrides, keeps nonzero exits as data, and requests termination on context exit. Includes typed options/results and public examples. Existing shared scenarios remain unchanged; this ports the P7 facade to Python.
Validated native lint, both type checkers, deterministic generation, 2,355 unit tests with 100% line/branch coverage, dependency audit, contract binding dry run, wheel/sdist smoke tests, and all isolated package/type extras. Review fixes select credentials by operation, refresh rejected user tokens with the captured session identity and stable request ID, and preserve body exceptions during cleanup. Native checks pass; final mutation reruns and remote CI remain pending. Live VM acceptance remains part of the coordinated staging rollout.
Coordinate with https://github.com/Kong/volcano-hosting/pull/1354 and Kong/volcano-sdk-ruby#316. No package publication.