8000 feat(sandbox): run the assistant's code on compute nodes by adeelahmad · Pull Request #572 · adeelahmad/lense · GitHub
[go: up one dir, main page]
Skip to content

feat(sandbox): run the assistant's code on compute nodes - #572

Merged
adeelahmad merged 7 commits into
mainfrom
claude/project-thread-sg6j7c
Oct 18, 2026
Merged

feat(sandbox): run the assistant's code on compute nodes#572
adeelahmad merged 7 commits into
mainfrom
claude/project-thread-sg6j7c

Conversation

@adeelahmad
@adeelahmad adeelahmad commented Oct 18, 2026
Copy link
Copy Markdown
Owner

Requested by Adeel · project thread

Description

Before: the assistant's run_python and run_bash could only run in a sandbox on this machine's OpenShell gateway.

After: the mesh (#546) can call sandbox.register_nodes(list_fn, driver_fn) to hand over the install's nodes, plus a Driver for each node's own gateway, which is reached over the mesh. Once it does:

  • run_python and run_bash take a node (an id or name, or here).
  • The new sandbox_nodes tool lists where code can run. For each node it says whether it can run code now, and why not if it can't: it isn't a compute node, it was removed, it hasn't reported in 3 minutes, the mesh is down, or it has no gateway.
  • A conversation's sandbox stays where it last ran. Moving it starts a fresh sandbox there and deletes the old one.
  • Sweep, forget and clear act on each sandbox where it is. Turning this machine's gateway off leaves the nodes' sandboxes alone, and a node removed from the mesh takes its sandboxes with it.
  • Each run's ledger row names its node.

Until nodes are registered, the model gets no sandbox_nodes and no node parameter, and everything runs here as before.

Motivation and Context

Last part of "Chat tools for Gmail, Calendar, Drive, S3 and Bash": Bash on remote VMs or microsandboxes over the Nebula mesh. The split with the mesh thread was agreed: this PR is the seam, and the mesh PR provides driver_fn talking to row["ip"]:7443. code_sandbox is SCHEMALESS, and an absent node means this machine, so no upgrade step is needed.

Types of changes

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to change; ! in the title)

Checklist:

  • The title is a Conventional Commit.
  • My code follows the code style of this project (make hooks checks it on commit).
  • I added or updated tests.
  • My change requires documentation updates, and I have updated docs/ accordingly.
  • Users need more than the title to understand it, so I wrote it under ## Unreleased in CHANGELOG.md.

Done questions (AGENTS.md)

  • Goal: the seam is merged on green; it does something once feat(mesh): Lens as the CA of a Nebula mesh between its machines, with join tokens and a node registry #546 registers nodes. The docs label it in progress.
  • Agents: assistant tools (sandbox_nodes, and node on the run tools) reach chat, the OpenAI-compatible endpoint and MCP chat.
  • Zero setup: nothing to set. Nodes come from the mesh.
  • Fewest clicks: none. The sandbox follows the conversation.
  • Configurable: no new setting. Each node uses the same sandbox.* settings.
  • Light: no dependency; the default install is unchanged.
  • Private and secure: node gateways are reached only through the mesh's driver. Nodes use the same policy, are used only when ready, and only when asked for or already holding the sandbox. Threat model md, yaml and json are updated.
  • Cost: no model calls; the ledger rows carry the node.
  • User decides: the model is told to pick a node only when the person asks for one or needs more power; nothing changes by default.
  • Upgrades: n/a. The new optional node field on code_sandbox means this machine when absent.
  • Honest: docs say "In progress" until the mesh merges.
  • Tested: a new end-to-end test with two fake OpenShell gateways covers listing, running on a node, staying there, refusals, moving back, sweep and delete. The sandbox, chat tools and web search suites pass.
  • Open: OpenShell, Nebula; MIT.
  • Reported in the project thread; the mesh thread was told the API.
  • Reuse: sandbox.Driver, OpenShell, _gateway, _ready, the sweep and the activity ledger.

Generated by Claude Code

@claude
feat(sandbox): run the assistant's code on compute nodes
3ff6742 
sandbox.register_nodes(list_fn, driver_fn) lets the mesh hand over the
install's nodes and a Driver for each node's own gateway. run_python and
run_bash then take a node, sandbox_nodes lists where code can run, and a
conversation's sandbox stays where it last ran; moving starts a fresh
one and deletes the old. Sweep, forget and clear act on each sandbox
where it is. Without registered nodes nothing changes.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GbBS222wEEQgkuui6CHo6c
@adeelahmad adeelahmad self-assigned this Oct 18, 2026
claude added 2 commits October 18, 2026 07:02
@claude
style: format the compute node sandbox test
61be512 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GbBS222wEEQgkuui6CHo6c
@claude
Merge remote-tracking branch 'origin/main' into claude/project-thread…
fb1fc33 
…-sg6j7c

# Conflicts:
#	CHANGELOG.md
@adeelahmad Claude
adeelahmad commented Oct 18, 2026
Copy link
Copy Markdown
Owner Author

Clicks on 61be512 failed with two 60 s timeouts waiting on the stand-in model's reply: first-question on the computer run and chat-research (new in #561) on the phone run, while each passed on the other device in the same job. This PR changes nothing in chat or research unless compute nodes are registered (none are in the survey), and test_research.py, test_sandbox.py and test_web_search.py pass on the merged head. I merged main (v0.15.0) in as fb1fc33, so Clicks runs again on that; if either journey times out again I'll treat it as real and dig in.

Generated by Claude Code

claude added 2 commits October 18, 2026 07:52
@claude
Merge remote-tracking branch 'origin/main' into claude/project-thread…
31bc30a 
…-sg6j7c
@claude
docs(readme): list the assistant's answers about Lens itself as built
ece8ece 
v0.15.0 released #400, so the requirements check fails while it stays
under In progress.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GbBS222wEEQgkuui6CHo6c
@adeelahmad Claude
adeelahmad commented Oct 18, 2026
Copy link
Copy Markdown
Owner Author

pre-commit on fb1fc33 failed the requirements hook: v0.15.0 released #400 while the README still lists it under In progress, so main fails this too. ece8ece moves it to the built list with its test_lens_help.py checks; it no-ops if main fixes it first.

Generated by Claude Code

claude added 2 commits October 18, 2026 08:47
@claude
Merge remote-tracking branch 'origin/main' into claude/project-thread…
e1d6869 
…-sg6j7c

# Conflicts:
#	README.md
#	docs/requirements.md
@claude
Merge remote-tracking branch 'origin/main' into claude/project-thread…
9ac7c5b 
…-sg6j7c

# Conflicts:
#	CHANGELOG.md
@adeelahmad
adeelahmad merged commit 0cf3eef into main Oct 18, 2026
12 checks passed
@adeelahmad
adeelahmad deleted the claude/project-thread-sg6j7c branch October 18, 2026 11:06
This was referenced Oct 18, 2026
Merged
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@adeelahmad adeelahmad

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@adeelahmad @claude
0